Bitcoin Forum

Always start from the phishing.

That's the reason to create an email for only used to exchange, wallets and only for your fund information his email could be already leaked to somewhere and the phishing know he also one of the cryptocurrency user that's why he phishing the victim with the right topic about "ledger" or "crypto".

I also have a bunch email right now, for only specific purpose like marketplace, gamble and crypto (exchange, fund and anything).

Agreed, the title is a bit misleading although not wrong too. It just give a wrong impression that Ledger is at fault here. Adding the word through Phishing might help to avoid misunderstanding here. There is no way to hack a ledger unless the owner send out the funds to the scam site. I'm not fully knowledgeable on Ledger security system but I believe even when you connect your ledger to a scam site, The hacker will never get your private key because the device itself is the key. So there device is safe on both physical and virtual attack.

Yes the person is dumb enough to click on anything, especially from good looking stranger woman who would say she love him long time.

Awareness can save us from this type of scam and phishing attack. Everyday I receive a lot of spam message in my mail, usually I ignore those. Even if I receive an important message in primary folder, I check the sender address before clicking on any link. As the thing happened earlier, Ledger wallet owners should stay careful.

The original domain is ledger.com and from the article I can see that scammer sent lẹdger.com link in phishing message. I tried to visit the link and it showing a warning message from Google Safe Browsing now.

https://i.imgur.com/KSzoV7k.jpg

That's why they need more education before trying to deal with the crypto. This is not the first time people getting fooled by the scammers through use the phishing site.
People should never click any link that comes to their email. I have a bunch of phishing emails that came from the scammers.
WTH was happening with people these days. They didn't even feel suspicious with phishing email.

Ive read the articles. In my opinion there is some issue of leaked data on the ledger few months back and if those lesked information goes to a bad person that usually do scam then he knows whose to target and probably follow by keeping him preoccupied with links with phishing attack. I clearly can sense this kind of responsibility too on part of ledger.

They did say that the leaked were overcome but how true? I know phishing to a scam site is individual own fault when got victimized but there is an inside incident on ledger part thats wht we dont know if they are also not to blame here.

This is what happened, the leaked information are now being used by criminals that's why it is very dangerous indeed. Because sooner or later, those criminals are going to target their physical homes, hammer and wrench attack and it could take lives of the victim.


Well in the sense that are partly to blame, how come the data or their customers have been leaked in the first? Unlike Trezor who doesn't maintain the database of their customers or at least they destroyed it so that no one can get their hands or it, whether internally or the hacker itself.

This is one of the weaknesses of people who are not that techy. First, we can also blame the Ledger since of their downside about able to breach their system.
Second, the victims should also blame themselves because maybe, some are not familiar with these kinds of things, or really 100% trusted everything.

A quick tip for everyone: Install Metamask extension in your browser, it may help you to be safe in some phishing websites.

I think the main problem will still be how to protect users, once you have the power to protect your personal data, equip yourself with tools that can detect the signs of attack public.
But does not mean that the people who leaked the user information must be responsible.

I panicked a little I thought someone breached the ledger and take ledger user's XRP I really think the user has some fault to it since he clicked the Phishing link. I really think user should be careful on what they are clicking on the emails to avoid this kind of incidents.

if you click everything you see in internet, of course you will be scammed. Especially if you you are a crypto holder you have to be extremely careful about everything. Even if you use a hardware wallet.

This is huge asset of Xrp in a ledger wallet which many users use this kind of wallet. This is very important not to click any links connected to your email as this may be the reasons of scam attacked. When it comes to emails I have different account of email to avoid this kind of scenario. I can't imagine losing million of coins that you save in a wallet so we must be cautious.

I hope you don't mind but this is not about the Ledger Wallet itself, as I understand with the situation it was the fault of the owner might accidentally send his XRP to the others with the use of a phishing site. Even if we use separate email accounts but can't sometimes be neglected scammers/hackers will tend to track you, the time that they see a leak on your account that's the time that they will put you in compromise.

To have this kind of incident, everyone could be cautious, not because you have a strong password, 2FA, or anything that involves security but the most important is to double-check the sites that we are using, mostly many have been tricked to this.

Awareness and education is the key to fight the phishing attack. We also need to be very vigilant because not all websites that we received from email and text messages are legit and need to be clicked. Ledger reputation is already ruined when they were breached and not this news makes it even worst.

It already shows a warning but it's too late, many have fallen for this scheme.

It is ignorance and carelessness on the part of the owner that he losses that huge amount of XRP, Ledger wallet is still safe what's not safe is how the owner's ignorance of how hackers works and phishing email works, in the first place how he acquired that ledger without getting proper education on how it works and how scammers, the blame is on him.

I think the problem  boils down on storing users private info on centralized system. I remember private information of the company's customers were hacked months ago, the hacker probably still managed to find way to use the hacked information to steal coins from their owners.

I think people should just be careful how they allow companies to store their private information on their servers.

And that's not small money to lost. Every crypto investors should know all important aspect to how they can fully secured their crypto assets .

Being a victim of phising website is one of the common reason why many people lost their crypto asset .that's why it's important to every one to separate the important email or any other documents from un important things . If you want to register in a website use different email  and always secured your main email  from different kind of spam and fraud .

The problem with a lot of people is they think hardware wallets are the ultimate security (and technologically they are) but it all boils down to user. You can put million dollar tech in a user's hands and it's worth zero if their online behaviors continue to be risky. You can put a free cheap tech (Wallet like Electrum) in a good user's hands and he uses it well with no issues.

People are too gullible and when they see the benefit they completely turn off the brain. In the crypto sphere you need an eye and an eye.

XRP again and again, I always hear bad news for XRP, is there no good news about XRP?
I understand the feelings of the holders, if XRP doesn't follow the next altcoin season, then this is bad history for XRP,
come on! XRP must have a good news. if if 1.1 million XRP were sold, I couldn't imagine what would happen in the market.

The first mistake happened by the Ledger team since they failed to protect their user's database. But unfortunately, we can't do anything that already happened. Since Ledger admits their mistakes and published the story behind it, that means we are aware of the leak of the database from Ledger. So when you have been receiving spam mails (unwanted mails) means there is something suspicious. Asking security updates by mail is more suspicious when it questions about fund management. Even I don't update my Ledger Live from the software. Yesterday I updated my Ledger live from the official website of Ledger. Just install the new version so it will replace the old version automatically. I often did it for my all wallet software.

To access to email / gmail is not an easy thing. It takes serious efforts to hack an email, because Google has made high security. But what we need to do is to take advantage of the strongest possible security system. GA, is a security key that can be difficult for hackers to penetrate. SMS notifications are also the best part of keeping your email safe.
If we use the email for any platform, use a different password for each platform.

Likewise with the hardware we use, if you have access to email. Try to use a different password.

How is it possible today to lose so much money with a phishing site, you just have to be carefull and make sure you are on the right website!

Thats right,  and people must double check before they click any link from their email
 but how can ? This scam site know the email address from ledger users
Regards

Phishing is something we really have to consider when we are using these type of wallets. When I am using my own metamask I realize that there is a big possibility my metamask could be compromised and that is why I care about which website I go to. Think about going to wrong website for just a second and allowing them to connect to your metamask, all of your money could be gone in seconds.

Someone who can build a fake website that resembles another website plus adds in option to connect to metamask could very well build a bot or a system that could empty anyone's metamask automatically without intervention which means it would just minutes before your money is gone. We are so used to going to many places and connect with our metamask, so we may not even realize we are getting hacked. Same goes with ledger, I just gave examples from metamask because I use that one.

yeah, but connect with Metamask should not allow website to clear your funds, just to see it, you need to confirm that you want to send your funds to that site, and for that, they need either your consent, or to hack your computer, i am pretty sure that by just connecting wallet to see the website, website cannot drain your wallet, since Metamask interrupts all transactions, and ask for permission

could you explain a little bit better your thoughts

Yeah, and it is a common recommendation in this forum, anytime someone ask for best and safest place to store their crypto assets, hardware wallet is often the number one recommendation but many people fail to understand that not everyone understand how to operate this hardware wallet and any mistake can probably lead to loss of funds, whichever way we chose to store our assets is okey as long as we are able to protect it properly.

Ledger and concerned strangers on the web are tirelessly reminding everyone to be vigilant with the links that they click on their emails. Because phishing attempts are everywhere and Ledger is very much aware of it.

I always received an update from the official Ledger email with the name of Katie and on the website of Ledger.com, you'll see this message at the top.

It's because he didn't check everything before clicking that phishing site until it was too late when he lost a whopping $1 million already. That's why we really need to think twice before clicking any link specially crypto related in our email because we really don't know for sure if that is a phishing link or not. Reminders are good, but if you are a Ledger user and not taking notes or reading them, then one day you might fall for this attempt.

Should be hardware wallets are the safest places to store our crypto, but without right knowledge this can happen. This is a fatal error from the ledger because user data are leaking.
Never click on a link from an email, especially if it is a bit suspicious, it would be better to bookmarks websites related to our crypto assets and if you want to know about the update it is better to find from official website not from the email notification.

How it is possible to transfer your asset without your wallet permission granted from the hardware wallet like Ledger. Everybody knows that it works online whenever you want otherwise all your asset kept in offline mode like a cold store. For hacking of your wallet, it required your 12 passphrases. So, mere leakage of email can't compromise a hardware wallet.

Well, another lesson to learn. In the world of cryptocurrency where there is a full of treat one must be creative when storing crypto and should not believe anything that has been sent to your email or something. Usually it is a trap and that one should avoid in getting to it. I suggest that whenever you wanted to invest in cryptocurrency is to make it offline and never let someone access it through the internet. Meaning to say that you should remain to store your crypto offline. The rest is that you need to be careful not to get affected by scam attempt using email with their trap being set up for you.

It's not a mere leaking of email addresses. The users were phished from an email sent to them by the hacker. The owners who got the email downloaded a malware from a fake Ledger site. This malware got access to the wallet's seed phrases. Clear enough? You would have known all of that if you only read the article.

 I dont understand why other people are not careful despite of they have big amount of money on thier wallet. For example  if we have million of xrp on our ledger wallet it is our responsiblities to become meticulous by checking 10 times or even 20 times every letters of website before clicking and visiting them, if you'll spot a substituted a homoglyph in the URL dont click and delete it immediately because 100 percent it is a phising site.

Absolving Ledger here is not the right way to go. Hackers got those emails from Ledger's data base in the first place. Those are probably personal and private accounts which they entrusted it to the wallet provider. They are still liable in part and those customers can sue them for damages in not protecting their data.

That was a very unfortunate incident thats why we should double-check any link first before we are going to accept it. so that we can minimize the risk of being victimized by phishing attacks. But why the Ledger wallet? I thought it was safe to use, By the way, in my opinion, It's not the Ledger wallet fault. because according to the article, It was a very organized phishing link that when the first time you look at it, you won't suspect because it looks the same as the Ledger site. dont know what exactly happen so I cant conclude any at the moment, All I can say is be vigilant as always because fraudster and thieves are always lurking around and waiting for the right time to attack.

Yes, you are right, but there will always be people who are just getting to know crypto, probably everyone has gone through it. For example, they also stole cryptocurrency from me, although I check everything very carefully.

No matter how secured wallet you are using,still you are responsible to hold everything right and here the owner of the wallet lost his assets just because of phishing attack so who is going to store huge amount of cryptocurrencies have to learn more about it because security of your funds is more important than anything.

There are more than 45 billion xrp in circulation and losing 1,1 million worth $287,500 maybe not worth significant compare to the circulating supply to affect the price.
Pishing site is one of the most common ways to hack, although it's easy to spot a substituted homoglyph, some people still fall for this trick, which means they are not paying attention to the URL. Yes, Ledger is part of this mistake but it's our duty to secure our asset and be careful of whatever may come to steal it.

It is really sad that this thing happens, maybe this is the reason that we need to tighten up our security in both mobile and pc in order for us to make sure that no one will make a bad move in our assets, but losing that amount is really a big thing, ledge company needed to tighten their security feature as well, and we as users should be aware with this thing too, not because it is hardware wallet, it is the safest of all.

sometimes people out of being too forward and eargerness will rush to click on phising websites. but one thing am sure of is that before i click on any mail i do check the source and make references. there is always a loophole that shows the differences between the real and fake. thats what we should always look out for.

This one is obvious but could still make a victim that has so much trust with "Team Ripple".
Since I was also a victim of a phishing attempt which was sadly successful, I learned my lesson.
Don't believe the bonuses.
If there is a log-in attempt, get away from it.
Changed my e-mail for my basic sign-ups. Damn, it's a load of work but it will be worth in the long run.

I don't get how the hack is carried out just from clicking a dodgy link, why does that mean the hacker suddenly has access to their hardware wallet? It's not like they now have the pin or key phrases?

Someone explain please..

Phishing is the biggest enemy of cryptocurrency asset holders and nearly every day there are reports of losing assets due to phishing.

I summarize there are 2 types of phishing from the article above:
1. phishing wallet website
2. Phishing extensions

Both of them are a drain on assets for beginners who don't have blockchain knowledge, it's useless to have millions of dollars in assets if you can lose them by phishing.

We are really neglecting this very basic thing and it had been suggested for how many times that we should make use of different emails and not
just focusing on one to make use in all accounts you do had neither on gambling, exchangers, wallets and any because phishing is rampant
and even if you are experienced or knowledgeable there would really be times on where you can skip out even on the slightest hint of possible phishing attempt.
These losses are commonly connected on human error.

Everything starts from the leaked email addresses, that is why using a different email address for crypto exchanges is the best option for protecting your database against cybercriminals. Leaked data will be sold on the dark side of the internet and the information will be open for hackers to make a new attack. The crypto exchanges should care about the security of hot wallets because usually, the hot wallets are under attack the hackers. Traders have to think about the possible security flaws too.

Be careful on all the emails that you are receiving, be sure that you opted for those emails and you are very familiar with those email, and if you see emails that you are not familiar you can hit spam or report it, and be careful on programs that you are entering your email there is a lot of risks involved, people are looking to spam and scam you.

Not only email leaks, but we also have to be careful when visiting websites, usually web phishing also appears in searches, that's why we must be careful and vigilant when visiting a website,
For example as in the news in this thread, phishing websites have the same url, there is only a dot below "n" that distinguishes it,
if someone is not careful, he will lose his assets.
https://i.imgur.com/vypzKyA.png

There's really not much Ledger users can do besides stop using their device, unfortunately -- at least the ones who were affected by the data breach. They will be harassed by whoever had access to the customer email list for probably all of eternity. The only other solution is for the user to change email addresses and abandon the old one.

i noticed that leakage of infos are now often happening this year not just to ledger owners and company because i also experience it and it was my first time i think to experience that my pass words and emails are being compromised on other sites and google browser also knows it because they reminded me . i know that leakage of infos are not new anymore but they got more stronger and they are attacking crypto users this time . if only users can be warned about the leak as early as possible , they can still be able to change thier details and avoided the hack .

There are always phishing attempt they never stop and they will never stop sending phishing emails if out of 1000 emails they sent 1 fall for it, and they scammed thousands of dollars, then it's worth their effort, so be always on the alarm about phishing emails because there will be no time that it will stop.

It would be a shame to lose a large number of XRP coins because in my opinion it is of great value. We really have to be careful in clicking on a link sent to our email because the link could be a phishing site. Vigilance is key in securing our wallets from being stolen by others

Woooow, that binance thing with dots underneath is wicked smart, that is someone who could have used his genius for something good and could have made a lot more money than this, dude used it for evil and not only he is doing something illegal and risky for his life, but he probably won't make a profit for a very long time, use it for good and build something great and you could profit from it forever.

At the end of the day I would say hackers and scammers and all the likes will continue to do their job because it is "easy" money according to them, I say we educate the public on these topics and try to ban these type of names, when a company gets big enough, all the binance and related keywords should be either bought or should come with a warning that says "you are going to a website awfully sounding like binance, but know that this is not THE binance you are looking for".

Another mistake clearly created by human error and nothing to be blamed into anyone or anything. This is an obvious claim to blame on the owner and user himself of the Ledger for getting into a scam site. Everyone must already know how risky it is getting into an unsecured site for your personal information is bare and is vulnerable to hacks. Why do always people commit the same mistakes of getting into an obvious scam when there are already recorded data of such things that have happened before? Simply, people do not learn from mistakes. They always commit the same mistakes for such wrong doings they have made. As a responsible crypto user,  you must be responsible enough to take good care of your funds not to be accessible from other people. This just shows how unknowledgeable individuals can be caught into obvious scams for not being aware of what they are doing. This calls for the attention that people must learn first before engage to avoid such the same mistake to happen again and again.

Ledger is not completely out of responsibility in this case: their database hack happened months ago gave scammer much more precise arrows for their bow, and I think it's Ledger duty to protect their customers data properly.
I received a couple of weeks a SMS to my personal cellphone calling me with my real name and surname ( sender was displayed as LEDGER ) saying me myu ledger device had a bug and I had to go to legal.ledger or seomething like that to update it.
Of course I didn't and a 5 minutes search on the net unveiled the scam attempt.
But one thing is ignoring generic pishing mails anoter thing is receiving a SMS on your personal phone with your real ID detail.

It is frightening to see that the criminals are becoming more smarter and they are experimenting with anything that could make them money. The basic rule i always follow is to never log into a site using any search engines. I always bookmark the legit website and that is how i go about things as you never know what all new phishing techniques these criminals will be using.

That is crazy, good thing that you never click their bait. These people are really smart but you are smarter than them  ;D.

It probably the same case that it happens to OP, he got fool in the trap set by hackers, and cliking on the link will redirect them to the phishing site and collect our personal details password, and the key. I'm sure that person had mentioned by OP is in the hurry just save his millions inside but it was very unfortunate that it compromise at all instead of saving it.

Just be careful with the links, don't click it if we are not sure.

Exactly that : when I received that sms I was driving and not near a pc and for some minutes I felt the urge to go to a pc and plug the ledger in to check everything was ok; then started to take some deeper breaths and tried to think clearly and it worked.
PS: I also try not to think I'm smarter than scammers... because that will be the day I will fall for them.

This case indicates that nothing is safe in cryptocurrency even though you using a hardware wallet. The best security of your assets is yourself. You must avoid any link from any site (email, telegram, ads) which you didn't know. Always check everything make sure that the link from the official. Also, you must have separate email only for your activity in crypto.

At first I was very surprised to read the title of this topic, it turned out to be only a phishing attack problem. This can be avoided
by increasing education, in order to provide awareness to many people not to randomly click on any links. Or at least check first
the addresses of the websites we want to visit, so we won't be victims of scammers. Whatever messages we get in our email,
please read them carefully before deciding to click sites contained in messages emails.