1. Who is saying the recent Ledger losses are scams?
Taylor Monahan, a security expert and co-host of the Uneasy Money podcast, says the newest Ledger-related loss reports she has handled involve owners who panicked and then fell for scams, not devices that were physically tampered with. She made the comments on the October 14 episode, which was recorded on Wednesday, and the claim is hers alone; it has not been independently confirmed.
On that episode, Monahan said that in the preceding couple of days the reports reaching her were not real Ledger drains. She distinguished them from the genuine thefts, which she attributed to a cellular implant found inside devices sold by the reseller CryptoBilis. In her telling, the two problems are separate: one is a hardware compromise confined to a specific seller, and the other is opportunistic fraud that grew out of the alarm the first one caused.
She did not say how many cases she has seen, so the scale of the scam wave is unknown. Her account should be read as an expert's observation from her own caseload rather than a measured count of losses across the industry.
Hardware wallets are designed to keep private keys on a dedicated device that never exposes them to a networked computer. The approach works well against malware on a laptop or phone, which is why the devices are popular with long-term holders. It works less well when the weakness is outside the device, in the purchase process or in the user's response to a deception, and the events of the past week touch both.
2. How are scammers targeting worried Ledger owners?
Monahan has been collecting reports about the incident all week and says she is working with Ledger, with help from Trezor, a competing hardware wallet maker. She listed several routes that she believes led to the losses: bad Google ads that appear when people search for how to install Ledger Live, fake applications, phishing sites, emails designed to frighten owners, and phone calls made directly to victims.
She said these add to the original losses simply from people panicking. Her advice to owners was brief: do not panic. The reasoning is that fear is the main tool of a scammer, who can offer a false fix to someone who believes their funds are at immediate risk.
The common thread is the recovery phrase, the list of 24 words that serves as the master key to a wallet. Fake apps and phishing pages typically ask the user to type that phrase to verify a wallet or restore access, and anyone who enters it hands over control of the funds. Ledger Support stated on X on October 14 that Ledger will never call or send direct messages, and will never ask for a user's 24-word recovery phrase.
The two threats call for different defenses. Tampering is best addressed by buying from trusted channels and checking that packaging is intact, while scams are best addressed by skepticism toward any request for the recovery phrase. Confusing the two can lead owners to take the wrong action, such as entering their phrase into a supposed verification tool in order to check whether a device is safe.
The scale of the confirmed thefts helps explain the fear. Bitquery's count of $102.0 million across 324 wallets works out to an average of roughly $315,000 per wallet, which indicates that the victims were holders with substantial balances. Holders of that size are exactly the people who would act quickly after hearing of a possible compromise, and scammers know it.
3. What do other security reports show about Ledger-themed phishing?
Separate warnings suggest that such campaigns are both real and active. On October 16, the security firm SlowMist warned of a phishing campaign posing as a Ledger firmware update that uses the incident as bait. In September, before the tampering reports, Zscaler ThreatLabz described a campaign in which fraudulent Google ads sent Ledger users to a fake page that asked for recovery phrases.
Neither report is tied to the cases Monahan described, so they should not be read as proof of her account. They do show that attackers were already targeting Ledger owners with this style of scam before the tampering news, and that the news has given them a fresh pretext.
The pattern is a familiar one in crypto security. When a high-profile incident makes headlines, impersonators follow quickly with fake support lines, fake updates and fake compensation offers, counting on the confusion of people who are unsure what is real.
Trezor's help with the case work is a small sign of cooperation between rivals. Hardware wallet makers share an interest in the public's confidence in the category, and a loss of trust in one brand can spill over to others.
Ledger Live is the companion application that owners use to manage accounts and install updates, which makes it a convenient disguise. A fake version or a fake firmware update can look authentic to someone who is hurrying, and the push to update quickly is itself a warning sign. Genuine updates do not ask for the recovery phrase at any point.
4. How did the hardware implant actually work?
The genuine thefts have a different cause. In its October 13 statement, Ledger said an unauthorized component inside CryptoBilis wallets read the recovery phrase from the device screen and sent it out over a cellular connection. The company says every confirmed loss involves a device sold through CryptoBilis, and it has not confirmed a total loss figure.
The blockchain data firm Bitquery counts $102.0 million taken from 324 wallets. That figure comes from the firm, not from Ledger, and the company has not verified it. Monahan said the affected devices in the reports she has seen were bought between June and early October, which gives a rough window for when tampered units were sold.
The distinction between the two kinds of loss matters for owners. A device bought from the seller named by Ledger may carry an implant and should be replaced, with funds moved to a new wallet created on a trusted device. A device bought elsewhere that is behaving normally is far more likely to be at risk from phishing than from hardware tampering.
The timeline is also worth noting. The first reports of drains came on October 9, Ledger's statement followed on October 13, and Monahan's remarks were recorded on October 14. Scams that appear within days of a security incident are typical, because attackers know that attention and anxiety are highest immediately after the news.
Searching for software through an advertisement is another weak spot. Paid search results can sit above the real site, and criminals buy them to catch people who type a product name in a hurry. Monahan named bad Google ads as one of the routes, and the September report on fraudulent ads leading to a fake recovery-phrase page describes the same technique.
5. What does Monahan do with her own wallets?
Monahan says she still uses both Ledger and Trezor devices but will be more careful about where she buys them. She spreads her holdings across multiple devices, locations and paper backups, so that no single failure would completely wipe her out.
Co-host Austin Griffith pointed to multisig setups as another layer. In a multisig arrangement, a transaction needs approval from several keys, and a hardware wallet is only one of the signers. If one device is lost or compromised, it can be replaced without handing an attacker control of the funds, because the other signers still have to approve.
These approaches reflect a view that no single piece of hardware should be trusted completely. Even a device with sound firmware depends on the supply chain that delivers it, and distributing risk is a way to limit the cost of a failure that cannot be foreseen.
6. What should Ledger owners do now?
The practical guidance that emerges is simple. Treat any unsolicited message, call or advertisement about a Ledger problem as suspect. Download Ledger Live only from the maker's official site by typing the address directly instead of clicking a search ad. Never enter the recovery phrase into a website, an app or a chat, and never read it to someone over the phone.
Owners who bought their device from CryptoBilis, the seller Ledger has linked to every confirmed implant loss, are in a different position and should follow the company's instructions on replacing the device and moving funds. Everyone else faces mainly the risk of being scared into an error.
The episode shows how a security scare can multiply its own harm. The implant affected a limited set of devices, but the publicity surrounding it created a wider group of anxious owners. Monahan's message, in effect, is that calm and verification protect people better than quick reactions to alarming messages.
For the wider industry, the case raises the question of how to communicate during a security event. Clear statements about which devices are affected, from whom they were bought and what owners should and should not do can reduce the room for rumor. Ledger's statements on October 13 and October 14, naming the seller and stating that it will never request a recovery phrase, follow that approach.
Owners who want to check whether a message about their device is genuine can contact Ledger through its official support channels rather than replying to the sender. Any request that creates urgency, threatens a loss of funds or asks for secret words should be treated as a scam, whoever claims to be sending it.