Why I wouldn't buy Ledger ever again?

[Pmalek]

I don't know if I'm talking nonsense
but wouldn't it be interesting for a company of this type, which sells hardware wallets, to delete all buyer data after the purchase has been made, completed, and without warranty or chargeback anymore?

I know that some countries' laws require them to store the data, but this is extremely dangerous

It's not as easy as that. There are numerous laws that govern how companies are supposed to treat your data and the purposes why they store it. Ledger is based in France. They are required to comply with EU data protection laws. On top of that, there are also various French laws that the company must respect. One of those concerns taxes, accounting, invoicing, and the like. I think that particular law requires French companies to keep customer data for up to 10 years. So even if your personal data that they keep for other purposes can be deleted, the tax & accounting law requires domestic companies to keep your data for a very long time.

[rdluffy]

...

It's not as easy as that. There are numerous laws that govern how companies are supposed to treat your data and the purposes why they store it. Ledger is based in France. They are required to comply with EU data protection laws. On top of that, there are also various French laws that the company must respect. One of those concerns taxes, accounting, invoicing, and the like. I think that particular law requires French companies to keep customer data for up to 10 years. So even if your personal data that they keep for other purposes can be deleted, the tax & accounting law requires domestic companies to keep your data for a very long time.

Thanks for the explanation
Here in Brazil, the government has a law called the “General Data Protection Law,” which stipulates that companies must define how long they will store customer data, but there is no definition of a minimum or maximum time frame 

In short, it doesn't work at all, because companies store customer data practically forever
And when there is a data leak, no customer is compensated

Nowadays, these customer data storage laws (in general) are quite outdated, with so many risks out there, especially in companies linked to crypto, investments, banks, etc

[Synchronice]

I don't know if I'm talking nonsense
but wouldn't it be interesting for a company of this type, which sells hardware wallets, to delete all buyer data after the purchase has been made, completed, and without warranty or chargeback anymore?

I know that some countries' laws require them to store the data, but this is extremely dangerous

You do not talk nonsense, that would be a great feature to have because when such a data exists, if it gets hacked, then hackers know exactly who owns crypto wallet, know their full name and living address. Probably, using a parcel forwarder company is a better way to ship products to the final destination because in this case, you only reveal your full name and not your living address.

By the way, it's impossible to find a company that will follow your idea. There is no way any company will sell hardware data without storing your data because they are required by law, probably in every jurisdiction, to store invoice and other buyer's data for many years.

[MusaMohamed]

Hey GUYZ,

HEY GUYZ,

Derdeeder, I just saw this here Ham 'n Ledger on wheebay and I wanted to git y'all's opinion on it since it looks to be a good deal.  What chu think?




I mean, it ain't no problem buying these things used, right?

Right?

Hardware wallets are only good and safe to use if they are Open-Source and Completely New.

If a hardware wallet is close-source like Ledger wallet, that's bad to use.
If a hardware wallet was used, and you want to buy it, it's very dangerous with likely backdoors to steal your coins when you fund coins in that wallet.

Knowing which hardware wallets are open source to buy and knowing how to buy a hardware wallet is important.
[LIST] Open Source Hardware Wallets.
[GUIDE] How to buy a Hardware Wallet the right way.

[Pmalek]

Check out the new type of phishing emails that scammers are sending to Ledger users, most probably to email addresses associated with various leaks.
They inform victims that they have been selected to attend a Ledger convention in Las Vegas. On top of that, they have won a special edition Golden Ledger hardware wallet. To accept the convention invitation and arrange delivery of the device, they need to click the "Accept invitation in Ledger Live" button. These scammers don't seem to have received the memo that the software is not called Ledger Live anymore.

My guess is that the button takes you to a fake Ledger Wallet link that then requires that you enter your personal information and recovery phrase.
I am sure there is no one here that will fall for something like this. Still, stay safe out there!

[Rikafip]

I am sure there is no one here that will fall for something like this. Still, stay safe out there!

Here probably not, but I am pretty sure some will fall for this (pretty weak imho) attempt.

My email address was among those leaked years ago, and for whatever reason I only got few phishing emails (iirc no more than 5-6 alltogether) and last one was several years ago.

[LTU_btc]

Check out the new type of phishing emails that scammers are sending to Ledger users, most probably to email addresses associated with various leaks.
They inform victims that they have been selected to attend a Ledger convention in Las Vegas. On top of that, they have won a special edition Golden Ledger hardware wallet. To accept the convention invitation and arrange delivery of the device, they need to click the "Accept invitation in Ledger Live" button. These scammers don't seem to have received the memo that the software is not called Ledger Live anymore.

My guess is that the button takes you to a fake Ledger Wallet link that then requires that you enter your personal information and recovery phrase.
I am sure there is no one here that will fall for something like this. Still, stay safe out there!

https://www.talkimg.com/images/2026/01/11/UFYAz2.jpeg

I also got this message. Last week Igot another kind of Ledger phishing scam:

Scammers is getting more creative because I haven't saw such message about Ledger and Trezor merger before. Usually I don't even notice such messages, but for some unknown reasons it wasn't moved to my spam folder, got it in my main feed.

[Pmalek]

I also got this message. Last week Igot another kind of Ledger phishing scam:
...

I can see how this can trick beginners and those who believe everything they read. That group of people won't waste 1 minute of their life to research if such a partnership has been announced on official Ledger and Trezor sources. After all, Ledger's CEO, Pascal Gauthier, wrote that email. No reason to believe that it's not a real merger.
It's probably the same old, same old. The button redirects you to a fake software download where you will ultimately need to import your seed phrase. And it won't be long before everything you have gets emptied and stolen.

[rdluffy]

I received this email today, and Gmail did not detect it as spam 




The button link is this one:

Code:

http://url4135.aerosimple.com/ls/click?upn=u001.VTzcEVVaJ3uReHWguGPjBFFuUebMNJdSteVil9wTgKCET5My4d8BufDN-2BswYztRthkbxikGqYK72sJRm5NqnVfQh3CdrDyA2J9YwXZuDsaw8q8gfrm58xJ3ecpsMxgdkyJLuaIEelYe-2FzFIv1CWbqAmFq9k0kJbx2uX61rBbcr3M9ZQsZtb0FPBDMfHhxxv-2FaEEAJ1YnZaTFq2bnB-2FkOCtIYAbhvdFJLvdcz8N32Cs-2FZGLO-2FThtSTUpQPrLqW6FRVidHxsaIKYlggVGj31NcDWe2hAG4mjkJrnsbFeXAtQoCyh9mdDskQlOYn2dogvdUIABpzMUqM-2Fp9zPCY3HtlHEG-2FFtZlPwj4mH9fu4xmqzhIuFGRn7-2FDjM7rDeLI1YEamqNVNvtjs5upT9WY-2FksoaW8az-2Fdd6lGbn4TASfM7TZ1M2cnQz0HtVg-2FL-2F-2BGiY0emsXOnl2DbdhLvkgOVPKTCg7urAj7mMezTy85PEBCN-2B-2B-2F6n6xyjHCh-2BLfpvEz2ABDHJlG7B0Ye-2Fe6E6yYNNcpPmw-3D-3DE1_j_hhG8qoiwxKp5AwaGjUkBOkN2delPz3yd5VPC9Gn-2B58Ra62uMcZdDfvoxbGSPY3OGGbmXaIJavZV7fCfgUqMgPD9rFOAEOOunmCt3-2BZKUB37liGNVOpwL5STaSDoB2bNFB45Cr5ViruRTxM00GAXl1-2FG08eICo-2F1s2dtHgJ3zqwerhWPWnQ0qAhPiSJr5GBsKopiaBiQOUDIbSgf-2FQXLTPg-3D-3D

Is there a service or website where I can check this link without having to enter in from my own PC?

[Lucius]

~snip~
Is there a service or website where I can check this link without having to enter in from my own PC?

Virustotal doesn't show anything malicious, and if you want to see what's on the link without being exposed to risk, there is an option (although I don't know how safe it is). As far as I can see, the link leads to a fake LL update page.

Code:

https://www.browserling.com/browser-sandbox

[rdluffy]

~snip~
Is there a service or website where I can check this link without having to enter in from my own PC?

Virustotal doesn't show anything malicious, and if you want to see what's on the link without being exposed to risk, there is an option (although I don't know how safe it is). As far as I can see, the link leads to a fake LL update page.

Code:

https://www.browserling.com/browser-sandbox

Thanks, exactly what I was looking for

Take a look at this scam:






They create a page simulating a firmware update, until they obviously reach a point where they ask for the seed

[Lucius]

@rdluffy, most of these scams always end by asking you to type in your seed, because as far as I know, no one has managed to install malicious firmware on Ledger, although some would say that Ledger already has it in an official form. I hope that there are not many people who will fall for such a trick, the seed is not entered anywhere except in the hardware wallet in case there is a need for recovery.

Besides, everyone should see that nothing happens on their hardware wallet even if they run this nonsense - new firmware always requires software + hardware wallet interaction which does not exist in this case.

By the way, someone reported the link and now a fraud warning is showing in browsers.

[The Sceptical Chymist]

<snip>
I know that some countries' laws require them to store the data, but this is extremely dangerous

It's not as easy as that. There are numerous laws that govern how companies are supposed to treat your data and the purposes why they store it. Ledger is based in France. They are required to comply with EU data protection laws. On top of that, there are also various French laws that the company must respect. One of those concerns taxes, accounting, invoicing, and the like. I think that particular law requires French companies to keep customer data for up to 10 years. So even if your personal data that they keep for other purposes can be deleted, the tax & accounting law requires domestic companies to keep your data for a very long time.

It's disgusting, because a conversation like this shouldn't even be ongoing when it comes to any hardware wallet.  The only reason (AFAIK) that data retention and the like are being fretted about in this section is because of Ledger's chicanery with their Recover rollout.  When you buy a hardware wallet, there's no reason you should be handing over any personal data to the manufacturer--and Jesus, if there is then fuck HW wallets altogether.  Electrum works just fine and if cold storage is needed, it's easy-peasy to etch that seed phrase down right along the barrel of your gun.

I've been asking myself for a long time if there are any honest people in crypto.  Seems like eventually almost everyone scams, lies, or does something to screw someone over.  Perhaps not the average users, but the ones who own exchanges, make wallets, get air time so they can influence people for their own personal gain....ugh, it's so frustrating and has not gotten better with time.

[ABCbits]

I received this email today, and Gmail did not detect it as spam 
--snip--

I tried opening aerosimple dot com (the homepage) and it appears to be normal website without any mention of cryptocurrency. I wonder if it's reason Gmail didn't detect it as spam, even though your screenshot shows there's no mention of "aerosample" at all.

[Pmalek]

I received this email today, and Gmail did not detect it as spam 

Rinse and repeat. This time scammers are using the buzzword "quantum" and the fear around quantum threats to try and trick victims into giving over their seed phrases. Regardless what is new in Bitcoin, there will be a scammer somewhere who will try to take advantage of it somehow.

@rdluffy, most of these scams always end by asking you to type in your seed, because as far as I know, no one has managed to install malicious firmware on Ledger...

Unofficial firmware releases can't connect to the official Ledger Wallet or Ledger's servers. They no longer call their native software Ledger Live. Now it's Ledger Wallet. It's easier to ask victims to enter their seeds into a phishing form than create a brand-new and fake Ledger Wallet software that probably wouldn't be able to interact with the hardware devices anyways.

[rdluffy]

@rdluffy, most of these scams always end by asking you to type in your seed, because as far as I know, no one has managed to install malicious firmware on Ledger, although some would say that Ledger already has it in an official form. I hope that there are not many people who will fall for such a trick, the seed is not entered anywhere except in the hardware wallet in case there is a need for recovery.

Besides, everyone should see that nothing happens on their hardware wallet even if they run this nonsense - new firmware always requires software + hardware wallet interaction which does not exist in this case.

By the way, someone reported the link and now a fraud warning is showing in browsers.

Yes, that's exactly why I wanted to check the link on a VM similar to the one you sent me
Now it's much easier to check this type of scam and links without having to install a VM myself and then have to uninstall it

I received this email today, and Gmail did not detect it as spam 
--snip--

I tried opening aerosimple dot com (the homepage) and it appears to be normal website without any mention of cryptocurrency. I wonder if it's reason Gmail didn't detect it as spam, even though your screenshot shows there's no mention of "aerosample" at all.

This is the official home page of aerosimple, and they are

The AI Platform for Airport Operations

Scammers probably created an email address on a real, reputable website to try to get past email filters 

I received this email today, and Gmail did not detect it as spam 

Rinse and repeat. This time scammers are using the buzzword "quantum" and the fear around quantum threats to try and trick victims into giving over their seed phrases. Regardless what is new in Bitcoin, there will be a scammer somewhere who will try to take advantage of it somehow.

And I hope no one falls for any of these scams anymore
The simple warning from wallets to never reveal of write your seed to anyone or any website would be enough to prevent almost all of these scams

[Pmalek]

The simple warning from wallets to never reveal of write your seed to anyone or any website would be enough to prevent almost all of these scams

In an ideal world, that should be enough. In combination with logic. But we don't live in an ideal world. Many people have the attention span of a goldfish, and can't keep their focus to read two sentences, let alone something more demanding. Common sense and logic is an ancient skill. I am sure people will fall victim to this and future scam attempts. Then they will blame the world, but without asking themselves, why would a legitimate software update require that I enter my seed!?

[ABCbits]

I received this email today, and Gmail did not detect it as spam 
--snip--

I tried opening aerosimple dot com (the homepage) and it appears to be normal website without any mention of cryptocurrency. I wonder if it's reason Gmail didn't detect it as spam, even though your screenshot shows there's no mention of "aerosample" at all.

This is the official home page of aerosimple, and they are

The AI Platform for Airport Operations

Scammers probably created an email address on a real, reputable website to try to get past email filters 

So it could be either
1. The scammer somehow hacked their domain/server to have some access, so they can send email as aerosimple dot com.
2. Owner of aerosimple intentionally sell/give access of their email to the scammer.
3. The scammer somehow spoof the email and not detected by GMail. But IMO it's unlikely.