Why anybody would use a link provided on social media to (try to) manage their Ledger device beats me. I figure that, in the heat of the moment, someone may have some sort of panic attack for some issue or other, and then go for whatever “help” they can get. The case listed in the OP seems of that nature, and the person implied ended-up rushing to a fake Ledger-of-a-kind site.

It’s pretty obvious that the first rule to access your Ledger device should be using the official software/site, and not any link provided on social media. It’s better to take a step back and think first, understanding that there are plenty of wolves hidden under sheep skin in the world (and even more so on a faceless-shameless environment).

I do understand security should be a personal business but that doesn't mean the advertisment big houses should show less concerned towards the safety of its users. What stop Google from reviewing every ad to reject potential harmful ones before they approved them for display.

Browsing through sites you will encountered hundreds of ad usually associate with Google AdSense which could be dangerous to devices or wallets. Somehow I feel this ad platforms are not doing enough to protect its users. If they were doing enough couple with the extra personal security measure from her users, we would had been recordings less number (or probably no number) of victims falling prey to this scams. Anyways good job OP creating this awareness.

Nothing new, users of hardware wallets are always targets of such attacks because this might be the easiest way to get all coins from the wallet which is very well protected from almost everything, except for the human stupidity associated with ignorance.

More then a month someone starts posting a link on Reddit with the fake tool to check seed words, and this attack is still in progress. Seed words should be only typed on the hardware device, and only in case it is necessary to get private keys for some reason, we can use tool from iancoleman on clean PC in offline mode. After that, we should consider that seed compromised.

Every Ledger device comes with a "Recovery sheet" for users to record their 24 words on. There are various versions, but all contain something along the following lines:
"These informations are uniquely linked to your wallet and you should be the only one to have access to them."
"Confidential 24 word recovery phrase"
"Store your recovery sheet in a secure place"
"Confidential - do not disclose"

Both the Ledger website set up guide and the Ledger Nano instruction manual state:
"Never ever share your 24-word recovery phrase, in any form, with anyone."
"Never enter your recovery phrase on any device other than your hardware wallet."
"Never take a picture of the 24-word recovery phrase."

In addition, when you initialize your device with Ledger Live, you get the following warnings:
"Carefully secure your 24-word recovery phrase out of sight."
"Make sure you are the sole holder of your recovery phrase."

The warning not to share your seed is on the paperwork that comes with the device, displayed on screen when you use it for the first time, in the instruction manual, and on their website. I'm not sure there is anywhere else they could possibly put it other than inscribing it on the device itself. If people still choose to ignore these instructions and enter their seed on random websites, then the fault lies with them, not with Ledger.

Yes, this is what happens

Some users do not try to understand that the secure lies on "seed never leaves the device". And they go and paste seed in Gmail Drafts, phsiing websites....

It is amazing how people create advanced devices with high security technology, to keep the seed in the device, in a way it cannot be discovered even if you plug the device in an infected computer... and someone goes and type the seed.


Of course, you are correct.

(I thought you were@LoyceV. Now we will have 3 twins here)

I complete agree. They should consider making their web page language selectable. They should be able to see the countries they get their traffic and sales from, so it should be pretty easy to establish the necessary languages to add.

The official reseller for my country is Amazon (really Ledger through Amazon's logistics), and there they logically have the info in the local language, but that is not really enough. Nevertheless, warnings, latest news, technical guides and even Ledger Live are all in English, which is still a problem for proper comprehension for many.

DdmrDdmr&gentlemand, we all know what a problem some users of this forum have with English language, so imagine if all instruction is on that language.  This can be maybe solved by using some translate tool (Google Translate), but it would be much better that two main hardware manufacturers make a multilingual website. I check Trezor site also, only English is available.

In addition to English, translation into Spanish, French, Russian would cover a good part of the world since most of Central and South American countries use Spanish (except Brazil), and French is still used in some of the former French colonies (Africa).