Ledger Regains Control of Discord Server Following Security Breach

Ledger, the well-known hardware wallet provider, has confirmed the restoration of its Discord server after a recent security breach. On May 11, an attacker compromised a moderator’s account, using it to post scam links that aimed to trick users into revealing their seed phrases.

The Incident: A Compromised Moderator Account

The attacker gained access to the Ledger Discord server by taking control of a contracted moderator’s account. With this access, they deployed a malicious bot to post scam links in one of the main channels. According to Quintin Boatwright, a Ledger team member, the bot encouraged users to click on fake links, leading them to a fraudulent website.

Users were prompted to enter their recovery phrases—the private keys that grant complete access to their crypto wallets. This attempt to deceive Ledger users into handing over sensitive information raised alarms across the community.

Quick Response and Containment

Ledger acted swiftly to contain the threat. The compromised account was disabled, the malicious bot was deleted, and the fake website was reported. Additionally, all permissions within the Discord server were reviewed and tightened to prevent similar incidents.

Despite the quick response, some users in the Discord channel claimed that the attacker used moderator privileges to ban and mute members who tried to raise the alarm. This action possibly delayed the community’s response time.

Not an Isolated Incident for Ledger Users

This is not the first time Ledger users have been targeted. Last month, scammers mailed physical letters to Ledger wallet holders, urging them to validate their recovery phrases on a fake website. The letters, branded with Ledger’s logo and business address, included QR codes that directed users to a phishing site.

The phishing attempt appeared to reference Ledger’s 2020 data breach, where hackers leaked the personal information of over 270,000 customers. This information included names, phone numbers, and addresses, making those users prime targets for social engineering attacks.