Loading Search...
A security researcher finds a scam of fake Ledger wallets on Chinese marketplaces designed to steal users’ seed phrases and funds.
Author: Arushi Garg
High attention and emotional sentiment detected.
17 April, 2026: A Brazilian security researcher has uncovered a large-scale operation selling counterfeit Ledger Nano S Plus devices on major Chinese e-commerce platforms.
In a post on X, researcher revealed that the fake devices closely mimic genuine Ledger wallets, including packaging and branding. However, the hardware is compromised. The devices use low-cost ESP32 chips and malicious firmware that captures seed phrases and PINs in plain text. The data is then transmitted to attacker-controlled servers across approximately 20 blockchains, according to the researcher’s analysis.
“These devices look identical to original Ledger wallets but are designed to steal seed phrases immediately during setup,” the researcher wrote in the linked post. The researcher’s findings are based on hands-on testing of a purchased device and reverse engineering of its internal components.
High Signal Summary For A Quick Glance
Lethe🇺🇦🇫🇮△□
@homefinlander
@TFTC21 Yeah, buy only from the manufacturer which then proceeds to leak their customer database. Don't use Ledger, period.
A security researcher just documented a large-scale counterfeit Ledger Nano S Plus operation selling compromised devices across multiple online marketplaces. The fake units look identical to the real thing but contain completely different hardware. Instead of Ledger's secure https://t.co/6ZfP9pJkUU
01:20 AM·Apr 17, 2026
Brad Messier
@KryptoBeard13
@TFTC21 The part that should keep people up at night: the genuine check can be bypassed if the hardware is compromised at the source. The one safeguard people rely on to verify their device is useless against the exact attack it was designed to catch. This is not a flaw in Ledger's
A security researcher just documented a large-scale counterfeit Ledger Nano S Plus operation selling compromised devices across multiple online marketplaces. The fake units look identical to the real thing but contain completely different hardware. Instead of Ledger's secure https://t.co/6ZfP9pJkUU
12:53 AM·Apr 17, 2026
X5
@fau1in
@TFTC21 @FBI @FBIDirectorKash this is serious stuff. These guys are scamming people of millions. The FBI didn’t even reply my email when I sent all the evidence of theft that happened to us.
A security researcher just documented a large-scale counterfeit Ledger Nano S Plus operation selling compromised devices across multiple online marketplaces. The fake units look identical to the real thing but contain completely different hardware. Instead of Ledger's secure https://t.co/6ZfP9pJkUU
12:18 AM·Apr 17, 2026
The researcher purchased a heavily discounted “Ledger Nano S+” from a Chinese marketplace after noticing suspicious listings.
Upon inspection, the researcher found the device uses a low-cost ESP32 IoT chip instead of Ledger’s secure element. Original chip markings had been physically altered. The firmware, labeled “Nano S+ V2.1,” was identified as malicious and designed to extract sensitive data, according to the researcher’s analysis. This follows previous reporting on hardware wallet vulnerabilities and supply-chain risks, reinforcing concerns around third-party sellers.
How counterfeit Ledger Nano S+ devices differ from genuine hardware wallets at a security level
Sellers listed counterfeit Ledger devices on platforms including Taobao, AliExpress, and Pinduoduo. Listings featured professional images and near-identical product descriptions to legitimate devices.
According to the researcher, the firmware also includes a backdoor mechanism that enables continued remote access after setup. The researcher warned this represents a shift from phishing attacks to physical supply-chain compromise at scale. Ledger did not respond to a request for comment by publication time.
Users should monitor Ledger’s official response, including any verification tools or warnings tied to specific listings. The scale of the scam remains unclear, including how many compromised devices have been sold.
Further developments may include enforcement action against sellers and new community-led verification guides to help users confirm device authenticity before setup.
Our Crypto Talk is committed to unbiased, transparent, and true reporting to the best of our knowledge. This news article aims to provide accurate information in a timely manner. However, we advise the readers to verify facts independently and consult a professional before making any decisions based on the content since our sources could be wrong too. Check our Terms and conditions for more info.
Bitcoin Quantum Debate Deepens as Hoskinson Flags BTC at Risk
Security researcher finds large-scale fake Ledger wallets on Chinese marketplaces
Chinese Professor With 2M YouTube Subscribers Says CIA Created Bitcoin
Drift Protocol Relaunches with $150M Tether Partnership
Bitcoin Quantum Debate Deepens as Hoskinson Flags BTC at Risk
Security researcher finds large-scale fake Ledger wallets on Chinese marketplaces
Chinese Professor With 2M YouTube Subscribers Says CIA Created Bitcoin
Drift Protocol Relaunches with $150M Tether Partnership
