Back Kucoin

Phishing Scammers Exploit Ledger Spyware Scandal with Fake Firmware Update

Kucoin • October 16, 2026

Phishing scammers are exploiting the recent $86 million Ledger spyware scandal with a fake firmware update campaign. Blockchain security firm SlowMist flagged the scam and shared screenshots of an email urging recipients to connect hardware wallets. The email claims the connection would protect devices against emerging spyware threats, including recent incidents in Malaysia. Such phishing campaigns commonly exploit fear created by security incidents. The campaign does not currently appear on Ledger's ongoing phishing scams webpage, which instead warns campaigns linked to data leaks.

Reports last week linked the mass draining of Ledger devices to authorized reseller CryptoBilis, which operates in Southeast Asia. Former CryptoBilis CEO Arravind Prabu said the company was acquired earlier this year, with a confidentiality agreement in place until October 19. After CryptoBilis changed hands, former Mt. Gox CEO Mark Karpelès found devices fitted with spyware that intercepted display data and transmitted the data through a hidden SIM card. The approaching confidentiality deadline and Karpelès' findings appear to have prompted the spyware operators to begin the operation, which took $86 million in cryptocurrency.

Unconfirmed reports have since circulated compromised devices in other regions. European reseller MediaMarkt has suspended sales. Ledger has urged other distributors to suspend sales as well. Ledger announced a new device yesterday. The phone-like Atom is an Android device with a data-only eSIM and cannot make calls.

Crypto forensics firm Chainalysis said a task scam operator was one of the largest and potentially most dangerous victims of the Ledger draining campaign. Chainalysis said more than 60 BTC, $4.8 million, was drained from three compromised Ledger devices. Chainalysis identified the funds as proceeds from a scam that paid people to fake sales and reviews of real items. The scam then tricked participants into sending money to withdraw payment. The funds reached the compromised devices just three weeks before the October 9 mass draining event.

Ledger CEO Pascal Gauthier shared Chainalysis' post, drawing criticism. One X user accused Gauthier of lacking self-awareness. Another X user called for Gauthier to resign. A third X user said Ledger deserved to go bankrupt.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Ledger Hardware Wallets Compromised by Spyware, $86 Million Stolen A significant security breach involving Ledger hardware wallets has been reported, with spyware implants found in devices sold by the Southeast Asian reseller CryptoBilis. These implants allowed attackers to remotely access wallet recovery data, leading to the theft of approximately $86 million in cryptocurrency. The incident has affected multiple users, including a scammer who lost $4.9 million in bitcoin after transferring stolen funds to compromised wallets. Reports indicate that Ledger received warnings about potential tampering months prior but failed to issue public alerts. Following the discovery, Ledger has suspended sales through affected partners and is conducting an extensive investigation. The spyware was reportedly able to transmit sensitive data over mobile networks, raising concerns about the security of hardware wallets. As of now, Ledger has not confirmed any direct link between the reseller's change in ownership and the spyware discovery. 13 sources 70

Extracted Entities

Phishing Scammers Exploit Ledger Spyware Scandal with Fake Firmware Update

The full story

Extracted Entities

Attack Types (1)

Companies (4)

Countries (1)

MITRE ATT&CK (1)

Platforms (1)