"Ledger support is calling": a 5-question check that stops fake support scams
Real wallet and exchange support never calls you first, never asks for your seed phrase and never asks you to move funds to a 'safe' wallet. If any of those happen, hang up and contact support yourself through the app or the address you type in by hand.
Why this is the attack that works now
Smart contract hacks get the headlines, but many of the largest personal losses in the past two years came from one phone call. On-chain investigator ZachXBT has traced several of them. The pattern repeats: someone calls or messages as "Ledger support", "Coinbase security" or "Trezor", says your account or device is compromised, and walks you through "protecting" your funds, straight into their wallet.
Show as table
| Value | Note | |
|---|---|---|
| Hardware wallet scam, Jan 2026 | $282,000,000 | LTC and BTC, converted to Monero within hours |
| Genesis creditor, Aug 2024 | $243,000,000 | the same group was linked to other thefts |
| Exchange and wallet support impersonated, Aug 2025 | $91,000,000 | 783 BTC |
| One US threat actor, several victims | $19,000,000 | total traced to a single person |
The theft is technically simple. Your keys are safe until you hand them over, type the seed phrase into a "verification" page, install "security software", or approve a transfer yourself. That is why the defence is a script, not a tool.
The 5 questions
- Did I contact them first? If not, stop. Ledger says plainly that it never calls, never DMs and never asks for your 24 words. Exchanges work the same way. An incoming call, SMS or DM is the scam until proven otherwise.
- Are they asking for the seed phrase, a private key or a "verification" of my words? There is no legitimate reason. The seed phrase is only ever typed on the device itself when you set it up or recover it.
- Are they asking me to move funds to a new "safe" or "vault" address? This is the most common ending of the script. Real support cannot and does not move your crypto.
- Are they asking me to install something or share my screen? Remote access tools give them your computer. Say no.
- Is there a deadline? "Your funds will be lost in 30 minutes" is pressure, not security. Real problems wait for you to log in yourself.
One "yes" is enough. Hang up, then open the official app or type the support address by hand (not a link from the message) and ask there.
How they find you
- Public support posts. Ask a question to an official support account on X, and fake "support" DMs you within minutes. Use the ticket system in the app instead.
- Leaked customer data. Old exchange and wallet shop leaks include names, phone numbers and home addresses, which is why the caller already knows your name.
- Paper letters and emails. Ledger has confirmed scam letters sent by post asking customers to "upgrade security" with their seed phrase.
If you already typed the seed phrase somewhere
Treat the wallet as gone. Set up a new wallet with a new seed on a device you trust and move everything that is still there right away, starting with the largest balance. Do not reuse the old seed for anything.
Related: address poisoning and how to buy meme coins safely.
Compare tools: Best crypto wallets
MemeSonar does this for you in real time: every new Solana token, every influencer call and every tracked wallet, scored and filtered for rugs.
Request accessNot financial advice. Numbers are measurements of past tokens and calls; meme coins are extremely risky and most go to zero.