Audit log

Every state-changing event for Ledger/Trezor Physical Mail Seed-Phrase Phishing Campaign (2026): moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-10-13 20:15:57Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 456,570,197

   sig

   3aJMchqEKzBD…fFMfa7HBcopyexplorer ↗

   hash

   4YkdBHHAVZE9…FcPgiqk1copysha256 → base58

   verifying row…full verify ↗

   canonical bytes (18745 B) ▸

   {"actor":"system:backfill","investigation_id":"0d3a5587-9b53-4fe8-9a42-84d323bcca46","kind":"publish","page_slug":"ledger-trezor-physical-mail-seed-phrase-phishing-campaign-2026","published_at":"2026-10-13T20:15:57.444Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Ledger/Trezor Physical Mail Seed-Phrase Phishing Campaign (2026)","sections":[{"content":"Victims receive a physical letter, sent by post, printed on paper designed to resemble official Ledger or Trezor correspondence, including company branding, a holographic seal, and a signature attributed to a company executive. The letters state that an 'Authentication Check' (Trezor-themed letters) or 'Transaction Check' (Ledger-themed letters) is becoming mandatory and that the recipient must act before a stated deadline or lose access to wallet functionality. A printed QR code directs the recipient to a phishing website that imitates the real Ledger or Trezor setup/authentication flow. The site walks the victim through a fake verification process and ultimately asks for their 12-, 20-, or 24-word recovery phrase, which it submits to an attacker-controlled backend. Once attackers have the recovery phrase they can import the wallet and transfer all funds, with no recourse available to the victim. Security researchers found that one fake Trezor letter was signed by a 'Matěj Žák, Ledger CEO' — Matěj Žák is in fact Trezor's real CEO, suggesting attackers conflated or recycled branding between the two companies.","heading":"How the Scam Works","severity":"critical","sources":[{"credibility":1,"name":"BleepingComputer — Snail mail letters target Trezor and Ledger users in crypto-theft attacks","type":"news_article","url":"https://www.bleepingcomputer.com/news/security/snail-mail-letters-target-trezor-and-ledger-users-in-crypto-theft-attacks/"},{"credibility":2,"name":"Rescana — Trezor and Ledger Users Targeted by Sophisticated Snail-Mail Phishing Attacks","type":"research","url":"https://www.rescana.com/post/trezor-and-ledger-users-targeted-by-sophisticated-snail-mail-phishing-attacks-cryptocurrency-wallet"},{"credibility":2,"name":"Cointelegraph — Scammers send physical letters to Trezor, Ledger users again","type":"news_article","url":"https://cointelegraph.com/news/scammers-send-physical-letters-trezor-ledger-users-again"}]},{"content":"The postal attack vector traces back to a December 2020 incident in which data belonging to roughly 272,000 Ledger customers, including names and physical addresses, was published on a hacking forum after an earlier breach of Ledger's e-commerce database. In 2021, criminals used that leaked address data to mail counterfeit Ledger Nano devices to victims, accompanied by instructions directing recipients to connect the device and enter their recovery phrase to 'migrate' their wallet; at least one recipient found the enclosed hardware showed signs of tampering. In January 2024, Trezor separately disclosed a breach of a third-party support-ticketing system that exposed the contact information of nearly 66,000 customers, creating a second pool of leaked addresses later alleged to support follow-on mail phishing.","heading":"Origins: 2020 Data Breach and 2021 Counterfeit-Device Mailings","severity":"high","sources":[{"credibility":1,"name":"BleepingComputer — Criminals are mailing altered Ledger devices to steal cryptocurrency","type":"news_article","url":"https://www.bleepingcomputer.com/news/cryptocurrency/criminals-are-mailing-altered-ledger-devices-to-steal-cryptocurrency/"},{"credibility":2,"name":"Rescana — Trezor and Ledger Users Targeted by Sophisticated Snail-Mail Phishing Attacks","type":"research","url":"https://www.rescana.com/post/trezor-and-ledger-users-targeted-by-sophisticated-snail-mail-phishing-attacks-cryptocurrency-wallet"}]},{"content":"In spring 2025, crypto users began reporting a renewed wave of Ledger-branded letters. Trader Jacob Canfield publicized one such letter, which carried Ledger's logo and told the recipient to complete a 'mandatory wallet validation' tied to a purported security update, directing them to scan a QR code and enter their recovery phrase or risk losing access to funds. Ledger responded on social media confirming the letter was fraudulent, stating: \"Scammers impersonating Ledger and Ledger representatives are unfortunately common... Ledger will never call, DM, or ask for your 24-word recovery phrase. If someone does, it's a scam.\" In late May 2025, BitGo CEO Mike Belshe separately shared a photo of a similar letter sent via the U.S. Postal Service, prompting further warnings from industry figures. Neither report quantified how many letters were sent or how many recipients were victimized.","heading":"2025 Wave: 'Mandatory Wallet Validation' Letters","severity":"high","sources":[{"credibility":2,"name":"The Block — Ledger confirms physical scam letters requesting seed phrase in fake security upgrade","type":"news_article","url":"https://www.theblock.co/post/352479/ledger-confirms-physical-scam-letters-requesting-seed-phrase"},{"credibility":2,"name":"Cointelegraph — Industry exec sounds alarm on Ledger phishing letter sent via USPS","type":"news_article","url":"https://cointelegraph.com/news/industry-exec-alarm-ledger-phishing-letter-usps"}]},{"content":"The campaign resurfaced prominently in February 2026. Cybersecurity researcher Dmitry Smilyanets reported receiving a fake Trezor letter demanding an 'Authentication Check' be completed by February 15, 2026, warning that the device would otherwise lose functionality; the accompanying phishing site, trezor.authentication-check[.]io, added that the deadline did not apply to buyers of certain Trezor Safe models purchased after November 30, 2025, a detail apparently meant to add authenticity. A parallel Ledger-branded letter, demanding a 'Transaction Check,' set a deadline of October 15, 2025, and routed victims to ledger.setuptransactioncheck[.]com (offline by the time of reporting). Both phishing sites ultimately requested a 12-, 20-, or 24-word recovery phrase and transmitted it to an attacker-controlled backend endpoint. BleepingComputer's Lawrence Abrams reported on the campaign on February 14, 2026. Cyvers CEO Deddy Lavid commented that scam campaigns do not decline during market downturns but instead evolve, noting that anxious, reactive investors are more susceptible to fear-based compliance letters of this kind.","heading":"February 2026 Resurgence: 'Authentication Check' and 'Transaction Check' Letters","severity":"critical","sources":[{"credibility":1,"name":"BleepingComputer — Snail mail letters target Trezor and Ledger users in crypto-theft attacks","type":"news_article","url":"https://www.bleepingcomputer.com/news/security/snail-mail-letters-target-trezor-and-ledger-users-in-crypto-theft-attacks/"},{"credibility":2,"name":"Cointelegraph — Scammers send physical letters to Trezor, Ledger users again","type":"news_article","url":"https://cointelegraph.com/news/scammers-send-physical-letters-trezor-ledger-users-again"},{"credibility":2,"name":"Rescana — Trezor and Ledger Users Targeted by Sophisticated Snail-Mail Phishing Attacks","type":"research","url":"https://www.rescana.com/post/trezor-and-ledger-users-targeted-by-sophisticated-snail-mail-phishing-attacks-cryptocurrency-wallet"}]},{"content":"By March 2026, a further variant of the letters was circulating, this time demanding recipients complete a 'Quantum Resistance Security Update' before the end of the month. North Wales Police's Cybercrime Unit publicly warned that the letters carried Ledger-style branding, the recipient's name and address, and in some cases a list of the recipient's specific devices, and said the scammers appeared to be using personal data from earlier Ledger customer data breaches to make the letters look genuine. The letters again directed victims to a QR code leading to a fake Ledger Wallet app page requesting a 24-word recovery phrase. Police advised anyone who entered a recovery phrase to immediately move funds to a new wallet with a newly generated seed, report the incident to the UK's national fraud reporting service, and retain the letter and any screenshots as evidence.","heading":"March 2026: 'Quantum Resistance Security Update' Letters and Police Warning","severity":"critical","sources":[{"credibility":1,"name":"Deeside.com — North Wales Police warns of fake security letters targeting cryptocurrency wallet owners","type":"news_article","url":"https://www.deeside.com/north-wales-police-warns-of-fake-security-letters-targeting-cryptocurrency-wallet-owners/"}]},{"content":"On January 5, 2026, Ledger disclosed that a third-party e-commerce partner, Global-e, had suffered unauthorized access to order data covering some Ledger.com purchasers, exposing names, postal and email addresses, phone numbers, and order details. Ledger stated that its own hardware, software, and private-key generation were unaffected, and that no payment credentials were taken. Some researchers have speculated that this breach — or similar earlier leaks — supplied the mailing addresses used in the February and March 2026 letter waves, since the timing coincides and the letters are personalized with accurate recipient names, addresses, and in some reports specific device models. However, this link is alleged rather than confirmed: neither Ledger nor independent researchers have publicly traced the letter campaign's mailing list to the Global-e incident specifically, and it remains possible the data originated from the 2020 Ledger breach, the 2024 Trezor breach, or another undisclosed source.","heading":"Suspected Link to January 2026 Global-e Data Breach (Unconfirmed)","severity":"medium","sources":[{"credibility":2,"name":"The Block — Ledger customers alerted to data leak at third-party e-commerce partner Global-e","type":"news_article","url":"https://www.theblock.co/post/384275/ledger-customers-data-leak-payment-processor"},{"credibility":2,"name":"Decrypt — Crypto Wallet Maker Ledger Confirms Data Breach on Global-e Platform","type":"news_article","url":"https://decrypt.co/353606/crypto-wallet-ledger-data-breach-global-e"},{"credibility":2,"name":"Rescana — Trezor and Ledger Users Targeted by Sophisticated Snail-Mail Phishing Attacks","type":"research","url":"https://www.rescana.com/post/trezor-and-ledger-users-targeted-by-sophisticated-snail-mail-phishing-attacks-cryptocurrency-wallet"}]},{"content":"Ledger and Trezor have both stated that they will never request a recovery phrase through any channel — not by website, email, phone call, QR code, or printed letter — and that any communication asking for one should be treated as fraudulent regardless of how official it appears. Ledger confirmed via social media in 2025 that the mailed letters attributed to it were scams. Law enforcement guidance (North Wales Police) instructs recipients never to scan the QR codes or enter a recovery phrase in response to such letters, to verify any claimed security update only by navigating directly to the vendor's official website, and to immediately transfer funds to a newly generated wallet if a phrase has already been entered, since recovery-phrase compromise allows funds to be emptied within seconds and is not reversible.","heading":"Vendor and Official Guidance","severity":"medium","sources":[{"credibility":2,"name":"The Block — Ledger confirms physical scam letters requesting seed phrase in fake security upgrade","type":"news_article","url":"https://www.theblock.co/post/352479/ledger-confirms-physical-scam-letters-requesting-seed-phrase"},{"credibility":1,"name":"Deeside.com — North Wales Police warns of fake security letters targeting cryptocurrency wallet owners","type":"news_article","url":"https://www.deeside.com/north-wales-police-warns-of-fake-security-letters-targeting-cryptocurrency-wallet-owners/"}]}],"sources_used":[{"credibility":1,"name":"BleepingComputer — Snail mail letters target Trezor and Ledger users in crypto-theft attacks","type":"news_article","url":"https://www.bleepingcomputer.com/news/security/snail-mail-letters-target-trezor-and-ledger-users-in-crypto-theft-attacks/"},{"credibility":1,"name":"BleepingComputer — Criminals are mailing altered Ledger devices to steal cryptocurrency","type":"news_article","url":"https://www.bleepingcomputer.com/news/cryptocurrency/criminals-are-mailing-altered-ledger-devices-to-steal-cryptocurrency/"},{"credibility":1,"name":"Deeside.com — North Wales Police warns of fake security letters targeting cryptocurrency wallet owners","type":"news_article","url":"https://www.deeside.com/north-wales-police-warns-of-fake-security-letters-targeting-cryptocurrency-wallet-owners/"},{"credibility":2,"name":"Cointelegraph — Scammers send physical letters to Trezor, Ledger users again","type":"news_article","url":"https://cointelegraph.com/news/scammers-send-physical-letters-trezor-ledger-users-again"},{"credibility":2,"name":"Cointelegraph — Industry exec sounds alarm on Ledger phishing letter sent via USPS","type":"news_article","url":"https://cointelegraph.com/news/industry-exec-alarm-ledger-phishing-letter-usps"},{"credibility":2,"name":"The Block — Ledger confirms physical scam letters requesting seed phrase in fake security upgrade","type":"news_article","url":"https://www.theblock.co/post/352479/ledger-confirms-physical-scam-letters-requesting-seed-phrase"},{"credibility":2,"name":"The Block — Ledger customers alerted to data leak at third-party e-commerce partner Global-e","type":"news_article","url":"https://www.theblock.co/post/384275/ledger-customers-data-leak-payment-processor"},{"credibility":2,"name":"Decrypt — Crypto Wallet Maker Ledger Confirms Data Breach on Global-e Platform","type":"news_article","url":"https://decrypt.co/353606/crypto-wallet-ledger-data-breach-global-e"},{"credibility":2,"name":"Rescana — Trezor and Ledger Users Targeted by Sophisticated Snail-Mail Phishing Attacks","type":"research","url":"https://www.rescana.com/post/trezor-and-ledger-users-targeted-by-sophisticated-snail-mail-phishing-attacks-cryptocurrency-wallet"},{"credibility":2,"name":"Bitcoinnews.com — Ledger, Trezor users targeted by physical mail scam","type":"news_article","url":"https://bitcoinnews.com/p/ledger-trezor-users-physical-mail-scam"}],"summary":"Since at least April 2025, scammers have mailed physical letters impersonating Ledger and Trezor to owners of those companies' hardware wallets, using holographic seals, forged executive signatures, and recipients' real names and addresses to demand a fake 'security check' via QR code. The QR codes lead to phishing sites that request the victim's 12-, 20-, or 24-word recovery phrase, which is then used to drain the victim's wallet. The campaign resurfaced in waves through 2025 and 2026, most visibly in February 2026 and again in March 2026, and both companies maintain they will never request a recovery phrase through any channel, including postal mail. This entry covers the mail-based phishing campaign itself and is separate from the main Ledger company page.","timeline":[{"date":"2020-12","event":"Data belonging to roughly 272,000 Ledger customers, including physical addresses, is published on a hacking forum following an earlier e-commerce database breach.","source":"BleepingComputer","source_url":"https://www.bleepingcomputer.com/news/cryptocurrency/criminals-are-mailing-altered-ledger-devices-to-steal-cryptocurrency/"},{"date":"2021","event":"Scammers mail counterfeit, tampered Ledger Nano devices to breach victims, instructing recipients to enter their recovery phrase to 'migrate' their wallet.","source":"BleepingComputer","source_url":"https://www.bleepingcomputer.com/news/cryptocurrency/criminals-are-mailing-altered-ledger-devices-to-steal-cryptocurrency/"},{"date":"2024-01","event":"Trezor discloses a third-party breach exposing the contact information of nearly 66,000 customers.","source":"Rescana","source_url":"https://www.rescana.com/post/trezor-and-ledger-users-targeted-by-sophisticated-snail-mail-phishing-attacks-cryptocurrency-wallet"},{"date":"2025-04","event":"Crypto trader Jacob Canfield publicizes a Ledger-branded letter demanding 'mandatory wallet validation'; Ledger confirms on social media that the letter is a scam.","source":"The Block","source_url":"https://www.theblock.co/post/352479/ledger-confirms-physical-scam-letters-requesting-seed-phrase"},{"date":"2025-05","event":"BitGo CEO Mike Belshe shares a photo of a similar Ledger-themed letter sent via USPS, drawing further public attention.","source":"Cointelegraph","source_url":"https://cointelegraph.com/news/industry-exec-alarm-ledger-phishing-letter-usps"},{"date":"2026-01-05","date_evidence":"Ledger disclosed the incident on January 5, 2026, and the breach was at Global-e, not Ledger itself.","event":"Ledger discloses that third-party e-commerce partner Global-e suffered unauthorized access to customer order data, including names, addresses, and phone numbers.","source":"The Block","source_url":"https://www.theblock.co/post/384275/ledger-customers-data-leak-payment-processor"},{"date":"2026-02-14","date_evidence":"Published February 14, 2026, 10:15 AM, by Lawrence Abrams","event":"BleepingComputer reports a new wave of 'Authentication Check' (Trezor) and 'Transaction Check' (Ledger) letters directing victims to phishing sites requesting recovery phrases.","source":"BleepingComputer","source_url":"https://www.bleepingcomputer.com/news/security/snail-mail-letters-target-trezor-and-ledger-users-in-crypto-theft-attacks/"},{"date":"2026-02-15","date_evidence":"the letter warns that users who don't act by February 15, 2026 could lose device functionality","event":"Deadline stated in the fake Trezor 'Authentication Check' letters for completing the fraudulent verification.","source":"BleepingComputer","source_url":"https://www.bleepingcomputer.com/news/security/snail-mail-letters-target-trezor-and-ledger-users-in-crypto-theft-attacks/"},{"date":"2026-02-17","date_evidence":"published Feb. 17, 2026","event":"Cointelegraph publishes follow-up coverage quoting Cyvers CEO Deddy Lavid on how scam tactics evolve rather than decline during market downturns.","source":"Cointelegraph","source_url":"https://cointelegraph.com/news/scammers-send-physical-letters-trezor-ledger-users-again"},{"date":"2026-03","date_evidence":"Posted: Tue 31st Mar 2026","date_original":"2026-03-31","event":"North Wales Police warns of a new letter variant demanding a fraudulent 'Quantum Resistance Security Update' from Ledger wallet owners.","source":"Deeside.com","source_url":"https://www.deeside.com/north-wales-police-warns-of-fake-security-letters-targeting-cryptocurrency-wallet-owners/"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision da6d2543-7551-45fd-8091-84cda8c3bee4copy