Fake Ledger 'system upgrade' email leads to device.identification14-ledger.app seed-phrase theft
PCrisk reports a phishing email impersonating Ledger, the hardware wallet maker. Under the subject "Your Device Needs An Urgent Update", it claims the recipient's device cannot complete the latest system upgrade, that…
- First reported
- Reports
- 1
Source: pcrisk.com · published
What happened
PCrisk reports a phishing email impersonating Ledger, the hardware wallet maker. Under the subject "Your Device Needs An Urgent Update", it claims the recipient's device cannot complete the latest system upgrade, that they risk losing access to their wallet, and that the update must be completed before 1 November 2026 through an "Update Now" button. The button leads to a fake site at device.identification14-ledger.app that mimics Ledger branding. At a "Verify Recovery Phrase" step it asks for all 12, 18 or 24 words of the wallet's recovery phrase, which would let the scammers drain the wallet. Ledger is impersonated and is not accused.
How the scam works
The email copies a security notice. It uses a firm deadline, a threat to lose access to funds and a single button to create pressure, and the sign-off line "Advancing crypto self-custody" and footer links such as Support Center and Ledger Live App make it look routine. The sender's display name looks like Ledger, but the address is not one the company controls. The domain it leads to, device.identification14-ledger.app, contains the brand name but is not Ledger's.
The aim is the recovery phrase. A recovery (seed) phrase is a list of 12, 18 or 24 words that controls a wallet; anyone who has it can move the funds from anywhere, and the theft cannot be undone. A real hardware wallet maker will never ask for the phrase on a website, in an email or on a call. Legitimate device updates are run through the company's own software, which you open yourself, and the phrase is never typed into it.
PCrisk concludes that this is a phishing scam disguised as an official security notice, designed to hand scammers complete and permanent control of the wallet's holdings.
PCrisk notes that campaigns of this kind are sometimes also used to distribute malware, rather than or in addition to harvesting credentials, so a click should never be treated as harmless.
Source
PCrisk, "Ledger Device Cannot Complete System Upgrade Email Scam" (removal guide, 27 October 2026).
Red flags
- An urgent email that says your hardware wallet can't complete an upgrade and sets a deadline.
- An 'Update Now' button that leads to a domain that isn't Ledger's own.
- A web page asking you to verify or enter your 12, 18 or 24-word recovery phrase.
- Threats of losing access to your wallet.
- A sender address that isn't from the company's real domain.
If you were targeted
- 1Don't connect your wallet, sign, or approve anything on the page.
- 2Never type a recovery (seed) phrase or private key into a website or give it to 'support'.
- 3Check announcements only through the project's official website or accounts that you open yourself.
- 4If you connected and approved something, revoke the token approval with your wallet's or the network's approval tool and move remaining assets to a new wallet if you're unsure what you signed.
- 5If you disclosed a recovery phrase, treat the wallet as compromised and move assets to a new wallet created with a new phrase.
- 6Report the site to your wallet provider and, in the U.S., to the FBI's IC3 at ic3.gov.