Ledger Discord Breach Contained After Scam Bot Incident

Ledger has resolved a Discord security issue after a compromised moderator account was used to push scam links targeting users’ seed phrases. The attack occurred on May 11 and has since been contained, with the team confirming that the server is now secure.

Good to know

• A bot used a moderator’s account to post phishing links pretending to be security updates.
• Ledger acted quickly to remove the account, shut down the bot, and report the fake site.
• Additional security checks have been introduced to prevent similar incidents.

The incident began when a scammer gained access to a contracted moderator’s Discord account. Once inside, the attacker used a bot to send messages urging users to verify their recovery phrases on a third-party website. The message claimed that Ledger had identified a new vulnerability and required immediate action.

In reality, the link led to a phishing page designed to collect seed phrases, which are critical for accessing cryptocurrency wallets.

Earlier in April, scammers sent physical letters to Ledger hardware wallet owners, trying to trick them into revealing their seed phrases to gain access and drain their wallets.

Ledger Responds and Locks It Down

Ledger’s team reacted fast. Quintin Boatwright, a Ledger team member, shared an update directly in the Discord server.

“One of our contracted moderators had their account compromised, which allowed a malicious bot to post scam links in one channel,” he said.

“The issue was quickly contained: the compromised account was removed, the bot was deleted, the website was reported, and all relevant permissions were reviewed and secured.”

However, some community members noted delays in response. According to messages shared on X, the attacker may have used moderator tools to mute or ban users who were trying to report the scam. That could have slowed down Ledger’s reaction time.

So far, there is no official word on whether any users lost funds or disclosed their seed phrases. The company has not confirmed if any wallets were compromised.