Observed arrival · 2026-09-11
The Fake Ledger Update That Wants Your Recovery Phrase
Credibility concern recorded. The source reference remains available for verification and correction.
A Ledger-branded device-update page that guides visitors through selecting a wallet and submitting a 12-, 18-, or 24-word recovery phrase.
Field notes
The page stages a five-model Ledger device selector before presenting fields for 12-, 18-, or 24-word recovery phrases. It then displays a claimed completed-update state with “Up to Date,” “Enhanced Security,” and “Verified” labels. A Ledger Recover FAQ adds brand-specific terminology and references to Coincover and EscrowTech, while the hostname remains ledgerfirmware-update.com rather than an apparent official Ledger domain.
Observed signals
Read the marks
Editorial observations of this landing page, not a rating.
One card from the complete issue