Taylor Monahan says recent Ledger losses stem from panic scams rather than hardware implants
Recent reports of Ledger wallet losses were caused by panicked owners falling for secondary scams rather than cellular hardware implants, according to security expert Taylor Monahan.
Recent Ledger-related losses reported in mid-October resulted from panicked owners making critical security mistakes rather than rogue hardware implants, according to security expert and Unchained co-host Taylor Monahan. Speaking on the Oct. 14 episode of Uneasy Money, Monahan explained that the newest loss reports she examined were not actual device drains from the cellular implants recently found in wallets sold by reseller CryptoBilis, urging users not to panic.[1][2][3]
Monahan, who is gathering incident reports alongside Ledger and Trezor, said victims fell prey to bad Google ads appearing on searches for Ledger Live, fake applications, phishing sites, frightening emails, and direct phone calls. In response to copycat attacks, Ledger Support emphasized on social media that the company will never call, direct message, or request a 24-word recovery phrase. Blockchain security firm SlowMist separately warned on Oct. 16 of phishing campaigns using fake firmware update notices as bait.[1]
The panic followed Ledger's Oct. 13 disclosure that an unauthorized component inside devices sold through third-party reseller CryptoBilis could read recovery phrases off device screens and broadcast them over cellular connections. While Ledger has not confirmed an aggregate loss figure, blockchain analysis firm Bitquery tallied $102.0 million taken from 324 wallets. Monahan noted that the compromised hardware she reviewed had been purchased between June and early October.[1]
Key facts
- Taylor Monahan stated on Oct. 14 that recent Ledger loss reports were caused by panicked users falling for scams rather than rogue hardware implants.
- Reported scam vectors targeting panicked users included fraudulent Google search ads, fake apps, phishing pages, scare emails, and phone calls.
- Ledger disclosed on Oct. 13 that unauthorized components inside wallets sold by reseller CryptoBilis read recovery phrases from screens and transmitted them over cellular connections.
- Bitquery counted $102.0 million drained across 324 wallets in connection with the CryptoBilis incident.
- Monahan noted that the affected devices in the reports she examined were purchased between June and early October.
- SlowMist reported a phishing campaign on Oct. 16 that used fake Ledger firmware updates as lure.
Sources · 2 sources
- UN
UnchainedArticle ·
Recent Ledger Loss Reports Stem From Panic Scams, Not Tampered Devices, Taylor Monahan Says Taylor Monahan , a security expert who co-hosts Unchained’s Uneasy Money, said the newest Ledger-related loss reports she has worked on came from owners who panicked and then fell for scams. Monahan said on the Oct. 14 episode of Uneasy Money , recorded Wednesday, that in the past couple of days “the reports that we’ve been dealing with are not actually Ledger drains” caused by the cellular implant found in devices sold by reseller CryptoBilis. Get Unchained’s crypto news in your inbox with the free Unchained Daily newsletter . Scams Aimed at Worried Owners Monahan said she has been collecting reports on the incident all week, is “working with Ledger,” and has had help from Trezor, another hardware wallet maker. She did not give a count of the cases she has seen. She listed the routes she said those losses took: bad Google ads that turn up when people search to install Ledger Live, fake applications , phishing sites, emails meant to frighten owners, and people who phone victims directly. All of these, she said, add to the original losses “just from people panicking.” “Don’t panic,” she said. Copycat attempts are circulating. Blockchain security firm SlowMist warned on Oct. 16 of a phishing campaign posing as a Ledger firmware update that uses the incident as bait. In September, Zscaler ThreatLabz described a campaign that ran fraudulent Google ads to steer Ledger users to a fake page asking for their recovery phrases. Neither report tied those campaigns to the cases Monahan described. Ledger Support wrote in an Oct. 14 post on X that Ledger “will never call you, DM you, or ask for your 24-word recovery phrase.” How the Implant Worked Ledger said on Oct. 13 that an unauthorized component inside CryptoBilis wallets read the recovery phrase off the screen and sent it out over a cellular connection. The company has said every confirmed loss involves a device sold through CryptoBilis , and it has not confirmed a total. Blockchain data firm Bitquery counts $102.0 million taken from 324 wallets. Monahan said the affected devices in the reports she has seen were bought between June and early October. Monahan said she still uses her Ledger and Trezor devices and will be more careful about where she buys them. She keeps her holdings spread across many devices, locations and paper backups, so that no single failure “will completely wipe me out.” Co-host Austin Griffith pointed to multisig setups, in which a hardware wallet is one of several signers and can be replaced if it is lost or leaks. Related Listen: Uneasy Money: Why Ledger’s Supply Chain Became a Nearly $100M Target The post Recent Ledger Loss Reports Stem From Panic Scams, Not Tampered Devices, Taylor Monahan Says appeared first on Unchained .
Open source - LS
Laura Shin@laurashinPost on X ·
"If you have a Ledger, please don't freak out, don't panic ... In the past couple of days though, the reports that we have been dealing with are not actually Ledger drains due to rogue LTE modems in the devices. It's people who panicked and then did something terrifically stupid," @tayvano_ on the Ledger reseller debacle https://t.co/6Q57EAq0SF
Open source - LS
Laura Shin@laurashinPost on X ·
Security expert Taylor Monahan says the Ledger loss reports she has handled in the past couple of days came from owners who panicked and then fell for scams, not from the cellular implant in CryptoBilis-sold devices. Her advice: "Don't panic." https://t.co/ZWFpcMGTMI
Open source