Essential Safety Rules Every New Ledger Users

[arzuo]

Ledger news: https://www.bleepingcomputer.com/news/security/ledger-customers-impacted-by-third-party-global-e-data-breach/

A data breach affecting customer information has been identified on the ledger. I select a few required following steps for new ledger users.

Easy, Safer Techniques:

1. Never click any email from Ledger (I recommend not clicking any email that looks real and is already from real people).

2. Do Not Share the Recovery Phrase Under Any Circumstances with the Support Team. Update the issue or not for any security alert.

3. Use Ledger Live for important/emergency purposes only from official sources.

4. Don't try to verify anything by clicking or installing software from links sent via email or social media.

5. Monitor transaction history and check your wallet activity regularly.

6. Immediately disconnect the device if you notice any unauthorized and unusual activity.

7. Ignore any urgent or threatening following messages, like

  “Immediate action required or need to verify”
   “Your wallet will be locked, or a chain issue will happen, etc.”

[Zaguru12]

I think at this rate we might actually be having a whole thread or even sub Board designated for ledger data breaches and it’s other related issues.

Not to downplay your effort in this thread but my ultimate essential safety rule for any new intending Ledger users will be Avoid Ledger Wallet at all cost

I think the damages of this ledger wallets and if I can say irresponsible team is getting way too much, best thing is for any one looking to go for hardware wallets is to stay clear as there are better and more reputable hardware wallets available which are open source and also some are airgap

[Yamane_Keto]

5. Monitor transaction history and check your wallet activity regularly.
6. Immediately disconnect the device if you notice any unauthorized and unusual activity.

These steps will not be helpful if unauthorized access occurs. Immediately disconnecting the device will not unblock the transaction broadcast if the broadcast is clicked, and tracking wallet activity will not recover stolen coins.

[Charles-Tim]

We have posted about Ledger several times that the wallet's secure element is close source, the wallet do not care about their users privacy. Not only that, if you are using Ledger, you may be using a custodial wallet. If you backup your seed phrase with the third parties, that means you are using a custodial wallet, also your wallet is not totally offline because the seed phrase which is divided into 3 parts are sent to the three third parties online.

[Rikafip]

Lol, another breach? Good job Ledger. 

Not only that, if you are using Ledger, you may be using a custodial wallet. If you backup your seed phrase with the third parties, that means you are using a custodial wallet, also your wallet is not totally offline because the seed phrase which is divided into 3 parts are sent to the three third parties online.

Afaik, no one is forcing Ledger uers to use that option to store their seed phrase.

[Charles-Tim]

Lol, another breach? Good job Ledger. 

If it is the third-party payment processor, Global-e system that was breached, it was discussed about on this forum yesterday. This is it: https://bitcointalk.org/index.php?topic=5570576.msg66258871#msg66258871

Not only that, if you are using Ledger, you may be using a custodial wallet. If you backup your seed phrase with the third parties, that means you are using a custodial wallet, also your wallet is not totally offline because the seed phrase which is divided into 3 parts are sent to the three third parties online.

Afaik, no one is forcing Ledger uers to use that option to store their seed phrase.

The argument is that there should be nothing like this at all, not to talk of it existing. Seed phrase are meant to be for noncustodial purposes but Ledger has turned its purpose upside down.

[Rikafip]

If it is the third-party payment processor, Global-e system that was breached, it was discussed about on this forum yesterday. This is it: https://bitcointalk.org/index.php?topic=5570576.msg66258871#msg66258871

Yeah I read the link in the first post.

The argument is that there should be nothing like this at all, not to talk of it existing. Seed phrase are meant to be for noncustodial purposes but Ledger has turned its purpose upside down.

I agree. My guess is that certain amount of their users lost their seed phrase and access to their crypto, so they came up with that ingenious idea which I suspect (unfortunately) many use.

[SFR10]

I select a few required following steps for new ledger users.

You might want to add the following to your list as well:

• If another package arrived at your doorstep or your P.O. Box and it claimed to be a replacement unit from Ledger or a special reward/prize from a mysterious Ledger contest, DO NOT OPEN & USE THOSE HWs.

[joniboini]

• If another package arrived at your doorstep or your P.O. Box and it claimed to be a replacement unit from Ledger or a special reward/prize from a mysterious Ledger contest, DO NOT OPEN & USE THOSE HWs.

Has something like this happened before? Sounds like an extra effort that costs more money from scammers targeted at random users, unless they explicitly know that the receiver has a lot of crypto. I guess they can track their purchase history to see if they've spent a ton of money buying a hardware wallet, but it's very easy to suspect the package is a scam if they haven't ordered anything at all.

[rdluffy]

I select a few required following steps for new ledger users.

You might want to add the following to your list as well:

• If another package arrived at your doorstep or your P.O. Box and it claimed to be a replacement unit from Ledger or a special reward/prize from a mysterious Ledger contest, DO NOT OPEN & USE THOSE HWs.

You mentioned the address
If any physical addresses were leaked, it would be a tragedy
Because I think it's extremely dangerous for a list like this to be leaked with crypto users' addresses

With the name, address, and social media accounts, criminals can not only send a fake hard wallet, but also directly threaten customers

[sunsilk]

5. Monitor transaction history and check your wallet activity regularly.

You can't just do that every single minute or seconds of your life. You'll only be surprised if the person who does it have been compromised already with his wallet and got drained.

And that can happen when he's been a victim of phishing already and have ignored the first in the list and that's about avoiding clicking any links sent to the email.

It leads to only few things, avoid clicking random emails/links and not connecting the ledger hardware wallet itself if you have no transaction to do.

[dkbit98]

First essential rule for every potentially new ledger user - don't waste your money on ledger hardware crap, and you can than me later.

I understand that majority of human beings are learning very hard, and prefer not thinking and using their brain, but even donkeys would learn to stay away from danger after everything that happened.

[nakamura12]

You mentioned the address
If any physical addresses were leaked, it would be a tragedy
Because I think it's extremely dangerous for a list like this to be leaked with crypto users' addresses

With the name, address, and social media accounts, criminals can not only send a fake hard wallet, but also directly threaten customers

It is a possibility that they will get threatened if the address and name are leaked. It is better to find a free wallet provider that is open source and non-custodial wallets rather than paying money for a wallet that didn't even consider the customer's data. Even a company that says they have strong security even got breached so a person should have just used different wallet after everything that's happened.

[Cookdata]

5. Monitor transaction history and check your wallet activity regularly.

You can't just do that every single minute or seconds of your life. You'll only be surprised if the person who does it have been compromised already with his wallet and got drained.

And that can happen when he's been a victim of phishing already and have ignored the first in the list and that's about avoiding clicking any links sent to the email.

It leads to only few things, avoid clicking random emails/links and not connecting the ledger hardware wallet itself if you have no transaction to do.

Seems OP doesn't know about wallet drainer, you don't have to monitor your wallet before it get drain if wallet is connected to a wrong website. The simplest way to get attack is if your email was among data breach, the worst that can happen get sent a phishing links or recovery phrase update lies, that's the two common scam attempt of ledger I have seen. Since these two are likely coming to your mail, include ledger email and any other word related to ledger on spams.

On any sight of ledger email, whether it's from the official ledger for promotion or any kinds, don't even read the jargon just include it on spam. If you continue to do this, you will likely receive no phishing mails again unless you ledger compromised your email again. This has happened like 5th time since that company has been in existence, I'm sure this is not going to be the last time it will happen.

Don't buy Legder.

[KiaKia]

I am not trying to offend anyone but if you are still using Ledger wallet today you are a dumb person,, the problems with Ledger can easily be figured out if their source code is open, but they made it closed source for some reasons only known to them, if you ask them why they chose closed source they will say they are trying to hide their hardwork so far so that someone else won't copy.

There are many better options to choose from right now, come to think of it I have never seen a complete open source wallet having some similar problem, it is always the closed source wallets.

Look around, what is working perfectly in crypto space today? Bitcoin, very transparent and decentralised, anonymous? Monero, stays privacy and anonymity, these things worked out because they are open source, transparent, decentralised, privacy enhanced, why wouldn't they work?

[SilverCryptoBullet]

First essential rule for every potentially new ledger user - don't waste your money on ledger hardware crap, and you can than me later.

There are many companies with hardware wallet products but there are good and bad ones, Ledger wallets are not good ones to use.

Close source.
Bad history of data breaches.

There are open source hardware wallets to use, see the following list if people want to find good ones to use. They also have to know how to buy a hardware wallet.

[LIST] Open Source Hardware Wallets.
[GUIDE] How to buy a Hardware Wallet the right way.
These guides are yours.

[Dave1]

As others have said, it's better to switch to a better hardware wallet as Ledger has a bad history already of hacks and other data breaches. So it doesn't make sense that you still stick with them as your personal data has been compromised already and you are like a sitting duck for phishing emails or even physical attacks (the worst).

The bad thing is now you should be like looking at your shoulder all the time as you don't know what's going to happened to you or to your family.

So again, watch out for phishing emails, it might be very sophisticated that you might be caught off guard.

[sunsilk]

5. Monitor transaction history and check your wallet activity regularly.

You can't just do that every single minute or seconds of your life. You'll only be surprised if the person who does it have been compromised already with his wallet and got drained.

And that can happen when he's been a victim of phishing already and have ignored the first in the list and that's about avoiding clicking any links sent to the email.

It leads to only few things, avoid clicking random emails/links and not connecting the ledger hardware wallet itself if you have no transaction to do.

Seems OP doesn't know about wallet drainer, you don't have to monitor your wallet before it get drain if wallet is connected to a wrong website. The simplest way to get attack is if your email was among data breach, the worst that can happen get sent a phishing links or recovery phrase update lies, that's the two common scam attempt of ledger I have seen. Since these two are likely coming to your mail, include ledger email and any other word related to ledger on spams.

Many are still not aware of these wallet drainers that it won't give them any notification once they're already infiltrated and their wallets are being siphoned by the hackers.

On any sight of ledger email, whether it's from the official ledger for promotion or any kinds, don't even read the jargon just include it on spam. If you continue to do this, you will likely receive no phishing mails again unless you ledger compromised your email again. This has happened like 5th time since that company has been in existence, I'm sure this is not going to be the last time it will happen.

Don't buy Legder.

I agree, whether it comes from an official ledger email. Never be curious to click any of the links they're putting in their messages.

Just avoid any of it at all cost and you'll just be fine and this isn't only for ledger users, but also with trezor and other notable hardware wallets.

[salad daging]

We have posted about Ledger several times that the wallet's secure element is close source, the wallet do not care about their users privacy. Not only that, if you are using Ledger, you may be using a custodial wallet. If you backup your seed phrase with the third parties, that means you are using a custodial wallet, also your wallet is not totally offline because the seed phrase which is divided into 3 parts are sent to the three third parties online.

Ledger is currently still opening seed phrase storage to third parties, is this service free or paid? I forgot and there was a discussion about this in the past, just wondering if there have been leaks from third party storage?

I never had any plans because the Ledger device no longer exists, it's not in use anymore, for the seed phrase only I know and it's safe, even if third parties offer high security it's still not worth it.

[uchegod-21]

As others have said, it's better to switch to a better hardware wallet as Ledger has a bad history already of hacks and other data breaches. So it doesn't make sense that you still stick with them as your personal data has been compromised already and you are like a sitting duck for phishing emails or even physical attacks (the worst).

The bad thing is now you should be like looking at your shoulder all the time as you don't know what's going to happened to you or to your family.

So again, watch out for phishing emails, it might be very sophisticated that you might be caught off guard.

The damage done to Ledger as a result of the bad history attached to its name will be difficult to erase. Even if Ledger improves its security now, alot of people will still be reluctant to use it because of the data leaks and highly convincing scams done through the leader. Due to how convincing the scam emails were, one needed to verify every mail sent to be sure of its authenticity. Along with avoiding links and reduction of crypto activities in the public space.

To me, Ledger is a mess already. There are other better wallets that respect privacy and guarantees the safety of your bitcoins.