Reddit

Nano

Read

This article has been updated with comments from a Ledger spokesperson.
A Brazilian security researcher has uncovered a sophisticated counterfeit Ledger device operation after discovering modified hardware designed to siphon cryptocurrency from unsuspecting users.
<div id="cn-block-summary-block_0f46a009f420519758558f8c001df461" class="cn-block-summary">
 <div class="cn-block-summary__nav tabs">Summary
 </div>
 <div class="cn-block-summary__content">
 <ul>
 <li>A Brazilian security researcher identified a sophisticated hardware compromise in a counterfeit Ledger Nano S Plus that utilized modified firmware to capture user recovery phrases.</li>
 <li>Physical inspections of the fraudulent device revealed the addition of unauthorized WiFi and Bluetooth components alongside a secondary manufacturer’s chip hidden beneath scraped markings.</li>
 <li>The operation relies on a deceptive QR code included in the packaging to lure users into downloading a malicious application designed to bypass official security checks.</li>
 </ul>
 </div>
</div>
The security researcher, known online as “Past_Computer2901,” <a href="https://www.reddit.com/r/ledgerwallet/comments/1sn0hk0/update_fake_ledger_nano_s_from_chinese/" rel="noopener noreferrer nofollow">shared</a> findings on Reddit after purchasing what appeared to be a standard Ledger Nano S Plus from a Chinese marketplace.&nbsp;
Despite the packaging and price point matching official retail standards, the unit failed a “Genuine Check” when connected to the authentic Ledger Live desktop application.&nbsp;
This red flag led to a physical teardown of the device, revealing that the internal circuitry had been altered to include WiFi and Bluetooth antennas—features entirely absent from the legitimate model.
<h2 class="wp-block-heading" id="hardware-manipulation-and-malicious-redirects">Hardware manipulation and malicious redirects</h2>
Scammers are utilizing these tampered devices to exploit first-time buyers through a deceptive setup process.&nbsp;
A QR code included in the packaging directs users to a fraudulent version of the Ledger Live app, which is programmed to bypass security warnings and issue a fake verification of the hardware’s authenticity.&nbsp;
You might also like: <a href="https://crypto.news/crypto-fund-founder-joe-mccann-questioned-after-fiancee-dies-in-zanzibar-hotel/" rel="noopener noreferrer nofollow"> Crypto fund founder Joe McCann questioned after fiancée dies in Zanzibar hotel </a>
Once a user follows the prompts to generate or enter a seed phrase, the compromised firmware captures the data, allowing the attackers to drain the wallet at will.
“This isn’t meant to cause panic, but rather to serve as a serious warning — I’m honestly still a bit shaken by the sheer scale of this operation,” the researcher noted.
Internal analysis of the unit showed that the scammers went to great lengths to hide the fraud, including scraping off original chip markings.
<figure class="wp-block-image size-large"><img width="777" height="1024" src="https://media.crypto.news/2026/04/image-80-777x1024.webp" alt="Counterfeit Ledger device.">
</figure>
Counterfeit Ledger device. Source: Reddit.&nbsp;
While the device initially identified itself as a Nano S Plus 7704 during the boot phase, the final sequence revealed the manufacturer as Espressif Systems, a Shanghai-based semiconductor firm.&nbsp;
These modifications fundamentally break the security premise of Ledger products, which are built to keep private keys in a strictly offline environment.
“When purchasing from a marketplace, Ledger strongly encourages users to verify the identity of the seller. Users should ensure they only download the official Ledger Wallet apps on desktop and mobile. The situation involved counterfeit hardware, paired with a fake companion app flow designed to simulate the onboarding process, distributed through unofficial channels,” a Ledger spokesperson told crypto.news.
“Ledger will never ask users for their 24 words. If anyone claiming to be Ledger, or any app that purports to be a Ledger app, asks for your 24 words, you should immediately assume it is a scam,” they added.
The discovery follows a separate incident earlier this month where a fraudulent app <a href="https://crypto.news/crypto-scam-fake-ledger-app-steals-9-5-million/" rel="noopener noreferrer nofollow">bypassed Apple App Store security</a> via a bait-and-switch tactic. The malicious software successfully tricked over 50 people into revealing their recovery phrases, resulting in the theft of $9.5 million before the platform removed the listing. The app has since been removed for malicious bait-and-switch functionality, according to Apple.
“Stay safe out there. Only download Ledger Live from ledger.com. Only buy hardware from ledger.com. If your device fails the Genuine Check — stop using it immediately,” the researcher cautioned.
Read more: <a href="https://crypto.news/israel-lebanon-10-day-ceasefire-starts-today/" rel="noopener noreferrer nofollow"> Israel-Lebanon Ceasefire Begins Today After Trump Announcement </a>

Researcher uncovers fake Ledger Nano S modified to siphon crypto assets

Table of Contents

crypto.news

Other articles published on Apr 17, 2026

Join our free newsletter for daily crypto updates!