People search “ledger hack” after the coins are already gone. Three different events hide under that phrase: a software drain on 14 December 2023, a customer-data leak from 2020 that still feeds fake support, and a message this week that asks for your 24-word recovery phrase. Ledger the company is real. The device in your drawer was not what moved the coins in most of these cases. What moved them is a signature you approved, or the recovery phrase you typed for someone pretending to be support.
The December 2023 incident was a website problem. Ledger's report says people were shown a transaction on a site that used the altered library, and the people who approved it had assets moved. The hardware was doing what a signature asks it to do. If your loss was that afternoon, say so in the form and keep the transaction hash. Ledger's own reimbursement commitment, as reported at the time, was for that incident and that window.
Everything since is contact. The leaked file tells a stranger you own a Ledger and where you live. The script is a security warning, a failed delivery, or a “mandatory firmware update”. The ask at the end is the recovery phrase, a remote-control app, or a shipping address for a device you did not order. Coins move when the phrase is typed, not when the email arrives.
A loss in 2025 or 2026 is not the December 2023 library incident. Treat it as the phrase, a signed transaction, or a fake app. Those are traceable when the coins reached an exchange. They are not covered by a 2024 reimbursement promise.
The hash, the approximate time, and whether you were on a website or inside an app. That is the trail. A screenshot of the balance is not enough on its own.
The text, email, parcel or chat, including the link and the phone number. If you typed the recovery phrase, say where, and when. Do not send the phrase itself. Not to us, not to anyone.
If the coins landed on an exchange, a freeze request has a clock. Card purchases of a fake device can still sit inside a dispute window. Both die if the only record is a memory of the day.
If the coins moved on-chain, read how a crypto trace actually works. If someone is now offering to “hack the hacker” for an upfront fee, read how to tell a real investigation from a recovery scam.
Concrete cases from our forensic review archive: an exchange brand whose deposit addresses we trace · an exchange whose impersonators cash out traced funds · a cloned domain whose wallet trail we documented
Two public incidents, and they are not the same. On 14 December 2023 Ledger reported that a library used by some websites was altered, and that people who approved a transaction on those sites had assets moved. Ledger said hardware devices and Ledger Live were not what was altered, put the impacted assets at about $600,000, and said those users would be made whole by the end of February 2024. Separately, in 2020 a customer database leaked: about 1 million emails and about 292,000 records with name, phone, address and product. Recovery phrases were not in that database. Most people searching this phrase today were contacted afterwards by someone using that leak.
The phrase is the wallet, so assume those coins can be moved. Do not type the phrase into any new site, including one that offers to recover them. The transfer after the phrase was used is a normal on-chain payment: it can be followed to the exchange where it is cashed out, and that is the point where a freeze is sometimes still possible. Bring the hash and the date. Do not send the 24 words.
No. A call, text, email or website that asks for the recovery phrase is not Ledger support, even if it knows your name, your address and which device you bought. That personal detail came from the 2020 customer-data leak. Close the page and type ledger.com yourself if you need the real support site.
The December 2023 reimbursement was Ledger's commitment for that incident. A later drain is a different case. Exchange freezes and bank disputes get harder as weeks pass, and they are not impossible on day one of finding the cash-out. A case review needs the hash and the date, not a perfect memory.
Comments are moderated. We only publish comments from verified clients.
Thank you. Your comment has been submitted for moderation and will appear after review.
Send the date, the transaction hash, and how you were contacted. Do not include the 24-word phrase. We will tell you whether the trail still reaches an exchange or a bank dispute. The assessment is free.
Tell us what's happening. We'll respond within one business day — or immediately for active investigations.