In a disturbing new development, cryptocurrency holders are being targeted through traditional mail in an elaborate scheme to steal their digital assets. Crypto trader Jacob Canfield recently exposed this scam on social media, revealing that fraudsters are sending official-looking letters claiming to be from Ledger’s security team.

Breaking: New scam meta launched. Now they’re sending physical letters to the @Ledger addresses database leak requesting an ‘upgrade’ due to a security risk.

Be very cautious and warn any friends or family that you know is in crypto and is not that savvy. pic.twitter.com/XoUAGQBJXt

— Jacob Canfield (@JacobCanfield) April 28, 2025

These deceptive letters instruct recipients to provide their 24-word recovery phrase as part of a supposed “critical security update.” Even more concerning, the scammers are likely using information obtained from a previous Ledger data breach that exposed the personal details of 270,000 users.

Sophisticated Impersonation Tactics

The counterfeit letter, designed to mimic official Ledger communications, creates a false sense of urgency by warning users that failure to complete this “mandatory validation process” could result in losing access to their wallets and funds.

Ledger’s Response To The Scam on X

Responding to Canfield’s post, Ledger quickly confirmed the letter as fraudulent, stating: “Scammers impersonating Ledger and Ledger representatives are unfortunately common.”

The company emphasized their standard security practice: “Always remember: Ledger will never call, DM, or ask for your 24-word recovery phrase. If someone does, it’s a scam. Stay cautious and keep your crypto safe.”

History of Targeting Ledger Users

This isn’t the first time Ledger customers have been targeted through physical means. In 2021, following a major data leak the previous year, users began receiving tampered Ledger devices in the mail designed to install malware when connected to computers.

As Canfield pointed out, Ledger may need to update their security warnings to explicitly include physical letters alongside digital communications like DMs and phone calls.

Protecting Your Crypto Assets

Cryptocurrency holders should remain vigilant against all forms of social engineering attacks. Remember that legitimate companies will never ask for your recovery phrase under any circumstances.

If you receive any communication claiming to be from Ledger or another wallet provider requesting sensitive information, contact the company directly through their official channels to verify its authenticity.