Watermelon Hub Update Phishing Scams Target Ledger Users

05 November 2026

A sophisticated wave of phishing attacks impersonating Ledger hardware wallet firmware updates is targeting Ledger users, security firms have warned. The scams aim to steal users' 24-word recovery seed phrases that control access to their crypto funds.

Scammers Impersonate Ledger Firmware Updates to Steal Crypto Funds

On October 16, blockchain security firm SlowMist warned of a phishing campaign targeting Ledger users via fake firmware update pages. The fraudulent sites imitate Ledger's "Genuine Check" flow and include an "Update Now" button – a classic strategy to exploit user trust in a trusted brand.

SlowMist stressed to never enter recovery seed phrases online and only to update Ledger firmware through the Ledger Live application, not via website links or emails. However, the attackers are targeting an additional vector – in-person seed phrase theft.

Exploiting Urgency to Harpoon Crypto Holders' Seeds

Another common factor in these pitches is urgency. The attacks frequently seek to capitalize on real incidents or fears to create a false sense of urgency.

The same report noted that the attack's goal was to trick users into clicking "Update Now" and then entering their wallet recovery phrase. Scammers sent mass "urgent firmware update" emails that led victims to a convincing fake "Genuine check" page.

Wareground Worm: The Fraudulent Flow

The hardware implant was spotted in a batch of allegedly compromised Ledger devices sold in Southeast Asia. Ledger asked resellers across seven markets in the region to cease sales.

SlowMist identified the attackers using the fake pages to collect seeds, with the scam taking an additional path to physical theft. Security firms estimated over $2 million in losses from the campaign.

Another twist has exploited email receipts to target Ledger users after an apparent leak of customer data. TrustStrike Labs warned that wallet users should expect more phishing attempts and to never enter seed phrases into "verification" sites.

Looking Ahead: Defending Your Seed

Going forward, security experts cautioned that these types of attacks are likely to keep evolving. The key is to maintain skepticism and verification habits.

The only reliable recommendation is to never expose your seed phrase to any external site or device, even if it claims to be your wallet provider, warns SlowMist.