Ledger regains control of Discord after hackers hijack moderator account

[_act_]

This scam is not new but it happened again.

Ledger discord server was compromised by hacker. Some users tried to caution people about it being a scam, but the hackers makes them not to be able to that. The hackers promoted users to another website to trick users to input their seed phrase. Coins of anyone that input his or her seed phrase will be stolen by the hacker. The hacker started by compromising one of the Ledger's moderator account.

https://www.mitrade.com/insights/news/live-news/article-3-813814-20250512

People especially Ledger users should know already this type of scam. The letters or mail sent to Ledger users recently is related to this as it contains a QR code that Ledger users can scan and use to update their seed phrase. If they put their seed phrase there, their coin will be stolen by the hacker.

[Sticky Bomb]

Just like you said, the scan is not new. We've seen a lot of it around. People should've been very much in the know that on no account should you disclose your seed phrases or private key to any media platform even if it was promoted by the moderators of such a site. It was even made more obvious when they reflected them to a third party site that isn't owned by ledger, That's the most obvious red flag.

It's " not your keys, not your coins" . When you share your keys in any form, then the keys cases being only yours and anything can happen to your coins.

[Agbamoni]

There should be more trusted software's solutions with robust security, rather than on companies solely focused on competition. Before now I have always preferred using Slack and to date, I have never encountered any reports of their system being breached. Discord became most peoples favorite but when it comes to security they are very poor in that. People are especially vulnerable to scams when the malicious messages originate from what appear to be official accounts of a trusted wallet company. Just like these one happened through the official discord server of Ledger. This failure in security left members of the server exposed to scammers attack.

[God Of Thunder]

The hackers promoted users to another website to trick users to input their seed phrase. Coins of anyone that input his or her seed phrase will be stolen by the hacker.

This is the important part. People have been warned hundreds of times that their hardware wallet never asks you to put your seed phrases on a website. Even if the instruction comes from their official X account or their official email, never follow this instruction. This is a scam attempt. People have to use their brains and common sense, and this is enough to save them from scams.

But unfortunately, new people are coming to the crypto industry and are still learning. This group of people are most vulnerable and they become the victim most of the times. Thanks for posting this OP.

[EluguHcman]

People especially Ledger users should know already this type of scam. The letters or mail sent to Ledger users recently is related to this as it contains a QR code that Ledger users can scan and use to update their seed phrase. If they put their seed phrase there, their coin will be stolen by the hacker.

I think I have seen similar discussion of these scammers asking users to update their seed phrases.

However, a well learnt wallet users will know that it is IMPOSSIBLE and IRRELEVANT to update wallet seed phrases hence it is generated along the wallet address which in the case of solid security purposes to deny invaders, thus the seed phrase that is tied on each wallets remains unchangeable.

So, it is better wise anyone in the position being asked to update their seed phrase should know that it is a scamming scheme.

For ledger official support if in case you want to verify if a parading website or email sent to you via update or upgrading of your ledger device or seed phrase, you can checkout on this https://support.ledger.com. it helps to detect phishing updates basically.

[Despairo]

Critical thinking is very important.

Even they're not get hacked, but they ask my login credentials or something that make them able to access my account/coins, I will not give it. I ever get asked to write my username, email and password when I contact the customer service due to having problem, like what? they only need email or username to track my account, not all my login credentials.

[Mia Chloe]

People especially Ledger users should know already this type of scam. The letters or mail sent to Ledger users recently is related to this as it contains a QR code that Ledger users can scan and use to update their seed phrase. If they put their seed phrase there, their coin will be stolen by the hacker.

One thing I've come to understand is that there is no 100% safe way to HODL your coins. The best you could possibly do is take them off the internet as much as you can and ensure you are also keeping them private. Hot wallets are not useless for Hodling but with the rate at which online flaws are being exploited it's best to hodl offline and with your seeds offline too.

Even with offline storages you have to also be careful of the kind of people that know about your Hodlings because you are still not 100% safe from robber's and burglars.

[btcltcdigger]

As long as the integrity of their wallet is safe, i'm fine. Social engineering scams will always work to some degree, and no one is trully safe, not even experienced mods.
Scammers are tricky, and sooner or later they will find a "trap" that people will fall for. Be vigilant and assume every message is a scam attempt, even from your mother

[Wiwo]

Ledger happens to be one of the wallet that bitcoiner and coin holders believe to be one of the most sort after cold wallet, so for sure if there is any compromise in their discord accounts it shouldn't affects Ledger wallet users so much unless the ones that make use of the discord page as means to reconnect with the wallet siver.

But for those that just focus on their wallet usage without following any link shared on social handles won't have anything to fear, between. I will never accept to use my wallet send phrase on any link that I copy from social media like discord since the handler can easily replace the original links to a phishing one just like in this situation.

[_act_]

One thing I've come to understand is that there is no 100% safe way to HODL your coins. The best you could possibly do is take them off the internet as much as you can and ensure you are also keeping them private. Hot wallets are not useless for Hodling but with the rate at which online flaws are being exploited it's best to hodl offline and with your seeds offline too.

This is more about imputing your seed phrase on a website for hackers to know about it and steal your coins. Even cold wallets are not resistant to this mistake if done.

Even with offline storages you have to also be careful of the kind of people that know about your Hodlings because you are still not 100% safe from robber's and burglars.

This is true because almost every time I am creating new topics about crypto theft nowadays on this forum. We also need privacy.

[Mia Chloe]

This is more about imputing your seed phrase on a website for hackers to know about it and steal your coins. Even cold wallets are not resistant to this mistake if done.

The thing is sometimes humans can be very careless and we need to grow so much in security and privacy as enthusiasts of decentralization to the extent that the slightest attempts for our coins to be stolen would be noticed by us. It's where hackers and scammers get an edge over their victims (tension and carelessness).

This is true because almost every time I am creating new topics about crypto theft nowadays on this forum. We also need privacy.

Yep the more we know the more informed we are and the more we are able to avoid for falling for any of their attempts. They'll keep coming up with more sofisticated ones and that's we it's important to stay updated.

[rdluffy]

Ledger once again 

If you use the simple principle that you should never put a seed anywhere under any circumstances, you'll be safe in almost all cases

Now what's worrying is the possibility of someone hacking into an official X or Discord account and putting a fake link to download a fake wallet
Then they could cause major damage because not everyone checks the software they download

[dumpsterhawk]

The hackers promoted users to another website to trick users to input their seed phrase. Coins of anyone that input his or her seed phrase will be stolen by the hacker.

This is the important part. People have been warned hundreds of times that their hardware wallet never asks you to put your seed phrases on a website. Even if the instruction comes from their official X account or their official email, never follow this instruction. This is a scam attempt. People have to use their brains and common sense, and this is enough to save them from scams.

But unfortunately, new people are coming to the crypto industry and are still learning. This group of people are most vulnerable and they become the victim most of the times. Thanks for posting this OP.

This kind of hack is always the user's fault. You are using technology where you do not have even the basic understanding of how it works and how you're supposed to do it. It is such as simple rule: Do not post or enter your seed phrase anywhere. How people are able to function on a daily basis and not adhere to this single rule is amazing to me.

Now what's worrying is the possibility of someone hacking into an official X or Discord account and putting a fake link to download a fake wallet
Then they could cause major damage because not everyone checks the software they download

Not really, it is the same thing. Does the software provider usually post links to download wallets like this? If not, then something is probably wrong. The more dangerous attack is a silent compromise of the usual method of delivery, like the download page of the ledger website.

[BIT-BENDER]

Why do they have to wait until they face this sort of scam before they know they have to establish a stronger security measure. The main social media group of any Crypto-currency entity especially one that holds people's funds should always be on high alert.
Over and over again this crypto-currency institution only learn after they have experienced an attack.
And to members on any Crypto-currency related social media groups you need to also be very careful.
Many of this staff may have something like will never dm you attached to their names but that doesn't mean you should fully trust them.

The truth is that you will be more safe if you stands on the fact that you should never give out your seed phrase to anyone.

[SquirrelJulietGarden]

Ledger self-destroyed its reputation with time from many data breaches and bad products like Ledger Recover, and now a hack on their Discord.

As a company that provides hardware wallets for user fund safety, security should be main concern from Ledger in product development, test, launch and operation as well as maintenance later. Ledger reputation is actually affected by security incidents like this one. It results in less trust on Ledger company with time and more security accidents.

After all Ledger was no longer a recommended hardware wallet to use especially there are many available better hardware wallets.

[Wiwo]

Ledger self-destroyed its reputation with time from many data breaches and bad products like Ledger Recover, and now a hack on their Discord.

As a company that provides hardware wallets for user fund safety, security should be main concern from Ledger in product development, test, launch and operation as well as maintenance later. Ledger reputation is actually affected by security incidents like this one. It results in less trust on Ledger company with time and more security accidents.

After all Ledger was no longer a recommended hardware wallet to use especially there are many available better hardware wallets.

Wallet supposed to be for security and privacy but in Ledger own case it a bit different and sure their have been caught up in many security mess in the pass and now I happening with the social media handles, although in this regards, I will blame potential victims more than I can blame Ledger as a hardware wallet company.

This because as a wallet user that knows the importance of a seed phrase, why on earth will you give out your seed phrase on an online platform knowing fully well how important their are, infact why should any one give out their wallet seed phrase in the first place.

[promise444c5]

Related to the physical mails scam that was here on this board recently..
Still ledger, it not recommendabke in the first place since its not open sourced yet again and again people need to stop inputing their seed phrase on websites , it doesn’t make sense. Once seed phrase is generated, its meant for ONLY the wallet owner and should  only be used for recovery when needed only.

[sheenshane]

Hoping there's data available to determine how many Ledger users have fallen victim to this type of scam.
Once again, another breach has occurred, they are truly not recommendable at all. 
Even their TrustPilot rating is only 2 stars out of 5.
https://www.trustpilot.com/review/www.ledger.com

I don't understand why they consistently experience breaches that damage their reputation.
What has happened to their technical team, which seems unable to safeguard their company's security and privacy?

[God Of Thunder]

This kind of hack is always the user's fault. You are using technology where you do not have even the basic understanding of how it works and how you're supposed to do it. It is such as simple rule: Do not post or enter your seed phrase anywhere. How people are able to function on a daily basis and not adhere to this single rule is amazing to me.

Right. If I don't know how to use something, either I should try to learn about it, or I should not use it at all. The problem is, people do not care about warnings. They think they won't be the victim of these scams until they become a victim. I believe the hardware wallet companies often send security warning emails to their customers. I own a hardware wallet as well, but I know how to use it.

People also fall or scams because they are geedy. If they hear offer like we are going to double your crypto as a appreciation because you were using our hardware wallet, they quickly fall for this scam thinking it is work like banks. Banks send us interested because we kept the money in my account. So, maybe the hardware wallet may give me some interest as well. That is why people get scammed.

[Orange89]

These is why I always say
Never type your seed phrase anywhere even
Not on a website
not in a DM
Not even on a Trusted support form

The second you do these, it’s game over for your crypto and your wallet
But sadly n o matter how many time these gets repeated  there are still people fall for it.

The hackers are getting really smarter
They don’t just spam you with obvious scam anymore nowadays but They will hijack real account by doing mimic support staff or just make a fake login page look exactly like the real one It’s not about being careless but it is about one quick moment of the distraction And that’s all scamer needs from you

That’s why education matters so much
If you are new to the crypto then take the time to learn the Tips watch other i mean learn from other by their compromise
And if you're experienced I will say Keep reminding others because the more the people are awared it will became the harder to gets scammer hacker to win

The same Things can be apply in both Even in hardware or software Wallet no matter