Reddit

Nano

Apple

Update April 18, 3:00 am UTC: This article has been updated to include comments from a Ledger spokesperson.
A Brazilian security researcher has warned others of the latest counterfeit Ledger device scam aimed at stealing users’ crypto.
Posting as “Past_Computer2901” on the “ledgerwallet” Reddit channel on Thursday, the security researcher <a href="https://www.reddit.com/r/ledgerwallet/comments/1sn0hk0/update_fake_ledger_nano_s_from_chinese/" rel="noopener noreferrer nofollow">said</a> they purchased what they thought was a legitimate Ledger device for personal use, but soon realized after it arrived that it was a sophisticated counterfeit aimed at stealing user funds.&nbsp;
“This isn't meant to cause panic, but rather to serve as a serious warning — I’m honestly still a bit shaken by the sheer scale of this operation,” they said.&nbsp;
Scammers are adopting increasingly sophisticated strategies to target users opting for <a href="https://cointelegraph.com/news/tether-self-custodial-wallet-gas-free-transactions" rel="noopener noreferrer nofollow">self-custody,</a> from supply chain attacks to social engineering and approval scams.
Earlier this month, more than 50 victims were tricked into revealing their <a href="https://cointelegraph.com/news/researchers-discover-malicious-ai-agent-routers-that-can-steal-crypto" rel="noopener noreferrer nofollow">seed phrases</a> on a fake Ledger Live app that made its way to the Apple App Store via a <a href="https://cointelegraph.com/news/apple-removes-fake-ledger-app-stole-9-million-from-users" rel="noopener noreferrer nofollow">bait-and-switch strategy.</a> The victims lost a <a href="https://cointelegraph.com/news/fake-ledger-app-apple-app-store-9-5m-crypto-theft-zachxbt" rel="noopener noreferrer nofollow">combined $9.5 million</a> before Apple took down the malicious app.
<h2 id="how-the-counterfeit-ledger-device-scam-works">How the counterfeit Ledger device scam works</h2>
The researcher said he bought the Ledger Nano S Plus from a Chinese marketplace, which was priced the same as the official Ledger store. The packaging and the listing also appeared legitimate at first.
However, when they connected the device to the genuine Ledger Live app — which was luckily already installed on their computer — it failed Ledger’s built-in “Genuine Check.”&nbsp;
This prompted them to pull apart the device, discovering modified hardware and firmware designed to capture and expose sensitive wallet data.
The security researcher said the scammers target first-time Ledger users, as the QR code that comes in the box would normally direct users to download a malicious version of the Ledger Live app that would show a fake "Genuine Check.”
Users continuing to follow the prompts will eventually allow scammers to obtain a user’s seed phrases and drain funds at any time.
<figure><img alt="China, Ledger, Hardware Wallet, Cybersecurity, Hacks" src="https://s3.cointelegraph.com/uploads/2026-04/019d99fd-6d25-7bab-92d8-73e44f35d5f6.png">
 <figcaption>Picture of the counterfeit Ledger device being taken apart. Source: <a href="https://www.reddit.com/r/ledgerwallet/comments/1sn0hk0/update_fake_ledger_nano_s_from_chinese/" rel="noopener noreferrer nofollow">Reddit</a>
 </figcaption>
</figure>
“Stay safe out there. Only download Ledger Live from ledger.com. Only buy hardware from ledger.com,” the security researcher said.&nbsp;
<blockquote>
 “If your device fails the Genuine Check — stop using it immediately.”
</blockquote>
After pulling apart the device, they discovered clear signs of tampering, including scraped chip markings and a WiFi and Bluetooth antenna embedded inside the unit.&nbsp;
Legitimate Ledger hardware products are designed to keep private keys fully offline.
Related: <a href="https://cointelegraph.com/news/musician-loses-420k-bitcoin-retirement-fund-after-installing-fake-ledger-app" rel="noopener noreferrer nofollow">Musician loses $420K Bitcoin ‘retirement fund’ via fake Ledger app</a>
The security researcher then looked into the firmware, putting the “chip into boot mode,” which initially identified the device as a Nano S Plus 7704 with an attached serial number.
However, once the boot sequence completed, another manufacturer’s name showed up: Espressif Systems, a publicly listed Chinese <a href="https://cointelegraph.com/news/taiwan-bitcoin-reserve-geopolitical-hedge" rel="noopener noreferrer nofollow">semiconductor company</a> based in Shanghai.
Cointelegraph reached out to Espressif for comment but didn’t receive an immediate response. A Ledger spokesperson told Cointelegraph that it has become increasingly important for the ecosystem to “raise awareness around counterfeit devices,” adding:
<blockquote>
 ”When purchasing from a marketplace, Ledger strongly encourages users to verify the identity of the seller. Users should ensure they only download the official Ledger Wallet apps on desktop and mobile. “
</blockquote>
Magazine:&nbsp; <a href="https://cointelegraph-magazine.com/whats-network-state-real-life-examples-big-questions/" rel="noopener noreferrer nofollow">What’s a ‘Network State’ and are there real-life examples? Big Questions</a>

Cybersecurity researcher uncovers fake Ledger sold on Chinese marketplace

Table of Contents

Cointelegraph

Other articles published on Apr 17, 2026

Join our free newsletter for daily crypto updates!