Security researcher Taylor Monahan reports that the recent wave of crypto losses is primarily driven by phishing scams rather than hardware defects. Attackers exploited public anxiety following a supply-chain incident to trick users into revealing their 24-word recovery phrases on fraudulent websites and apps.
The initial security issue involved unauthorized hardware implants in Ledger devices sold by the authorized reseller CryptoBilis. These implants captured recovery phrases during setup without compromising the device's Secure Element, allowing them to bypass standard authenticity checks.
Ledger confirmed that the hardware tampering was isolated to units from CryptoBilis. However, the subsequent phishing campaigns targeted a broader audience. Estimated losses from the entire episode range from $70 million to $100 million, with on-chain data suggesting $86 million to $93 million.
The company advises users not to activate Ledger devices purchased from the affected reseller within the last 90 days. Owners of such units are encouraged to transfer their funds to a new, secure wallet, as any device from that source should be considered compromised.
Ledger reiterated that it never requests recovery phrases from users. The company emphasizes that direct sales remain unaffected and warns that recovery phrases should never be entered into any website, application, or online form, regardless of the perceived urgency.
