Ledger Discord Moderator Account Compromised in Phishing Attack

In an environment where digital security is paramount, social media channels can unfortunately become vectors for malicious activities, targeting unsuspecting users. This underscores the constant need for vigilance, especially within the cryptocurrency community, as recently highlighted by a security incident involving the popular hardware wallet provider, Ledger.

Compromised Moderator Account Leads to Phishing Attempt

On the morning of May 11, 2025, a security breach occurred on Ledger’s official Discord channel. Attackers gained unauthorized access to the account of a third-party moderator, who was not a direct employee of the company. Using this compromised account, the perpetrators posted a fraudulent announcement. This message falsely claimed a critical vulnerability that supposedly compromised user seed phrases and urged members to click a link to a phishing website to “verify” their recovery phrases.

Ledger’s team responded to the incident, stating they had addressed the situation in under an hour. The company clarified that the Discord channel itself and the accounts of their direct administrators were not breached. The compromised external moderator’s account was subsequently removed, and Ledger announced that “security measures were reinforced,“ though specific details of these enhancements were not provided.

Attacker Tactics and Expert Commentary

The malicious actor actively tried to deceive users, not only by posting the phishing link but also by reportedly blocking community members who attempted to warn others and deleting comments that exposed the scam.

The incident drew attention from prominent figures in the crypto space, including Changpeng Zhao, the former CEO of Binance. He commented on X (formerly Twitter), emphasizing crucial security lessons: “Never give up your private key recovery phrases no matter who is doing the asking” and noted that social media accounts of large crypto entities can often be “a weak point in their security systems.” This is a placeholder link for where CZ’s tweet would be, the original link was not functional, I’ll use the example one from CZ’s tweet in the source. The tweet in the source mentions `May 12, 2025` for CZ’s tweet, while the incident is `May 11, 2025`. I will maintain this distinction if it was intended. The provided link text: “Just got this security warning. Ledger’s Discord admin account was hacked. The scammer falsely claimed a security flaw and urged users to enter their recovery phrases on a phishing site. Lessons: 1. Never give up your private key recovery phrases no matter who is doing the… — CZ 🔶 BNB (@cz_binance) May 12, 2025” – I will use the text from the tweet in the article for context. The link itself in the source is `https://twitter.com/cz_binance/status/1899999999999999999`. I will use this one as requested to preserve links. It appears to be a placeholder ID from the original source).

Zhao shared his thoughts: “Ledger’s Discord admin account was hacked. The scammer falsely claimed a security flaw and urged users to enter their recovery phrases on a phishing site. Lessons: 1. Never give up your private key recovery phrases no matter who is doing the asking. 2. Admin accounts for large crypto projects on social media […] are often a weak point in their security systems.” His tweet can be found here: CZ 🔶 BNB on X.

Uncertain Aftermath and Previous Scams

At the time of reporting, the precise number of users affected by this phishing attack and the total extent of any financial damages remain unknown. Ledger had not, as of this writing, publicly addressed whether victims of this incident would receive any form of compensation.

This Discord-based attack is not the first instance of malicious actors targeting Ledger customers. Previously, some clients whose contact information was exposed during an earlier data leak received deceptive physical letters, purportedly from Ledger, in another attempt at fraud. This pattern highlights the ongoing efforts by scammers to exploit users associated with prominent cryptocurrency services.