Ledger Nano X in 2021 – What’s New and How to Not get Scammed – My Updated Review

In the unfortunate event this happens, you will most likely have some time to use your 24 word recovery phrase on a new device to access your funds again, and transfer them to a new wallet. Here’s how. As you know, the wallet operates with a 4- or 8- digit pin. The seed gets wiped out from the device if a wrong pin is entered three times in a row, so the device is protected against brute force attacks. There are talks about other methods a hacker can potentially use to access the data on the chip however, those require time and specialized equipment.

It’s no rocket science that malware can infect your PC without you or your antivirus noticing it. Once a PC is infected, you can no longer trust what’s displayed on your computer screen. While your Ledger will prevent hackers from accessing your recovery seed and wiping your wallet completely, they can still reroute your payment to a different address if you’re not cautious enough.

Solution: When making a transaction, make sure to follow the steps detailed here. Also, ideally you want to keep your wallet accessing PC offline and only for that purpose, and have a different PC for regular web surfing.

Note: Please do not confuse a MITM attack with a normal BTC address change due to UTXO. If confused, read this topic.

9 months ago, a man created this thread where he claimed that his Ledger got hacked remotely. After some investigation, it became clear that the man downloaded a third-party Chrome extension for the wallet, and introduced his 24-word seed there.

Lesson learned: the official Ledger app will never ask you for your 24 words. Besides, there is no official Ledger Chrome extension, so that app the man downloaded was clearly made by scammers.

Some people buy their devices from sites like eBay and Craiglist. You can find some really “sweet” deals there but here’s the thing – nothing comes for free.

Back in 2018, a young hacker named Saleem Rashid claimed to have being able to hack a Ledger device. His method requires him to have the physical device in order to install a custom firmware on it through USB.

As far as I know, this issue has been addressed, and the Saleem Rashid now appears on Ledger’s hall of fame. Now, it’s unknown whether there are other ways to exploit a Ledger device so the lesson is pretty clear: avoid third-party sellers.

Don’t get me wrong – the Ledger Nano X is a very secure device that also has an inbuilt integrity check system. Still, it’s a good idea to play it as safe as possible.

As this blog post by Kaspersky Labs details, a hacker could potentially install a hardware implant on the Ledger to make it leak your funds. While it’s certainly not easy for a hacker to get their hands on your device if you order it directly from Ledger, it’s always better to be safe than sorry.

Solution: Ledger devices are easy to open, and this short tutorial shows how to easily disassemble your Ledger Nano, and check whether it’s been tampered with.

As this video explains, some third-party sellers replace the original Ledger documentation with their own.

What they do is they basically pre-set the device for you. They create a private key and print two copies of it. They put one copy in the box and cover it with scratch-off ink, making it look like this is how it came from Ledger. The second copy remains in the possession of the scammer, allowing them to access your funds unless you reset your device and create a new set of recovery words.

You might think “who will fall for this?”. Thing is, with over two million Ledger devices being sold worldwide, you can bet there’s a good share of people who could potentially fall for this.

There have been (and probably still are) quite a few phishing websites that look exactly like Ledger’s. The main aim of those websites is to lure you into sharing your 24 word recovery phrase.

Takeaway: Ledger will never ask you for your 24 word recovery phrase, neither it will ask you to send them cryptos. Please, take a minute to check this screenshot compilation to get a better idea on how creative scammers can be.

Back in June of 2020 there was a data breach on Ledger’s e-commerce site API that leaked the contact information of over 8500 Ledger device owners. The leak consisted of strictly email addresses, phone numbers and names. No payment or credit card information was compromised. Nonetheless, this allowed scammers to send both emails and text messages to Ledger users, prompting them to click on links that would lead them to phishing websites.

Takeaway: While this particular breach was fixed, it’s a good idea to take any emails and messages with a grain of salt, even if they contain your full name. Data breaches happen even to the biggest companies, so please don’t click any links from emails no mater how credible they look like.