A new wave of scam emails is targeting Ledger users, attempting to steal their cryptocurrency holdings.
The scam emails aim to convince users to activate a so-called security feature, “Ledger Clear Signing,” by Oct. 31 to continue using their Ledger device.
The emails — sent from addresses not associated with Ledger — direct users to a malicious link to activate the fake security feature. The phishing email states:
“To continue using your Ledger device securely, activating Clear Signing is mandatory starting November 1, 2024. This feature is essential in protecting your assets from phishing attacks and fraudulent activities that are becoming more sophisticated.”
Scam email impersonating Ledger. Source: Cointelegraph
Phishing scams deceive users into willingly sharing their account details with scammers. Crypto users should avoid clicking suspicious links or providing any personal information to unknown sources.
Related: UK, Colombia crypto exchanges linked in TD Bank record fine
Cointelegraph has approached Ledger for comment.
Phishing attacks are becoming increasingly common in the crypto space. In May, a trader lost $71 million worth of crypto in the year’s most high-profile phishing attack. The attacker tricked the trader into sending 99% of their funds to the attacker’s address.
Scammers continue vying for Ledger users
Ledger’s hardware wallets are among the most popular in the industry, making its users prime targets for scammers.
However, the current wave of emails is a “very clean Ledger scam,” according to Thomas Roccia, senior threat researcher at Microsoft.
In a follow-up post, Roccia noted that the scam link redirects users to a URL that is completely unrelated to Ledger.
Scam email impersonating Ledger, urlscan.io. Source: Thomas Roccia
Phishing attacks are a growing concern in crypto
Despite their unsophisticated nature, phishing attacks are a growing concern in crypto.
Phishing attacks stole approximately $46 million in September from around 10,800 victims, according to the onchain security firm Scam Sniffer. The biggest loss was reported on Sept. 28, when a phishing attack using a permit phishing signature drained 12,083 spWETH worth $32.43 million.
Related: SUI price rally sparks $400M insider selling allegations
In August, crypto phishing attacks surged by over 215%, with $66 million worth of digital assets stolen from around 9,145 victims.
The majority of the stolen value in August was attributed to a single large-scale phishing attack worth $55 million.
On Aug. 20, an unfortunate crypto holder signed a transaction that changed the ownership of 55.47 million Dai (DAI) in the decentralized finance protocol Maker.
$3 billion stolen in hacks — Why are crypto crimes surging? Source: YouTube
Magazine: 10 crypto theories that missed as badly as ‘Peter Todd is Satoshi’