Crypto scammers enter physical world with letters to Ledger users

As sending emails and making phone calls is not enough, crypto scammers are now also sending physical letters to potential victims, reminding us of the importance of protecting our privacy.

Major cryptoasset hardware wallet manufacturer, French company Ledger, has confirmed reports on social media, warning about the ‘scam letters’.

"While we actively report and block scammers, we can't control what accounts — real or bots — choose to say in their emails, phone calls, bios or usernames on X. This remains an ongoing challenge across platforms," the company said.

Ledger once again stressed that it will never call or send a direct message to its clients, and will never ask for the 24-word recovery phrase, which grants access to user wallets.

"If someone does, it's a scam," the company emphasized.

It was reacting to a post by crypto influencer Jacob Canfield, which showed pictures of letters allegedly received by Ledger customers regarding "mandatory wallet validation" following "a critical security update."

With these letters, the scammers are trying to trick potential victims into entering their recovery phrase online after scanning a QR code printed on the letter.

Most likely, the criminals obtained the addresses of Ledger customers from the major database leak in July 2020. At the time, an unauthorized third party accessed the company's e-commerce and marketing database, which contained around 1 million email addresses. Additionally, 9,500 customers had their personal information exposed, including first and last names, postal addresses, phone numbers, or details of ordered products.

Meanwhile, in a separate report, crypto bug bounty platform Immunefi said that the crypto ecosystem witnessed $1.7 billion in total losses in the first four months of 2025, a 4x increase compared to $420 million during the same period last year. However, this increase is mostly due to the Bybit hack, which resulted in around $1.5 billion in losses.

In April alone, $92 million was lost due to hacks across 15 specific incidents, which is 27% more than the losses registered in April 2024, and 2.2 times more than in March 2025. Hacks continued to be the predominant cause of losses compared to fraud, Immunefi concluded.