Ledger Discord recovers after hacker bot targets users with scam links

Ledger confirmed its Discord server was secured following a security breach on May 11, when an attacker compromised a moderator’s account to post phishing links aimed at stealing users’ seed phrases.

Quintin Boatwright, a member of the Ledger team, stated on the company’s Discord channel that a contracted moderator’s account was hacked, allowing a malicious bot to share scam links in one of the channels.

“The issue was quickly contained: the compromised account was removed, the bot was deleted, the website was reported, and all relevant permissions were reviewed and secured,” Boatwright said.

Some Discord members reported that the attacker misused moderator privileges to ban and mute users who tried to report the breach, potentially delaying Ledger’s response.

Boatwright emphasised that the incident was isolated and that Ledger has implemented additional security measures to protect its Discord community, a platform widely used by crypto projects for communication and updates.

Screenshots shared on social media showed the hacker using the compromised account to claim a recent vulnerability in Ledger’s security and urged users to verify their recovery phrases through a scam link.

Users were prompted to connect their wallets and follow on-screen instructions, which could have led to theft of funds.

It remains unclear if any users were affected by the breach. Ledger has not yet provided further comment.

This Discord incident follows earlier scams targeting Ledger users. In April, scammers sent physical letters to Ledger hardware wallet owners, requesting validation of private seed phrases via QR codes linked to fraudulent sites.

These letters used Ledger’s branding and contact details to appear legitimate. Some users speculated the scammers accessed customer data leaked during a 2020 breach, when personal information of over 270,000 Ledger customers was exposed.

In 2021, several users reported receiving tampered Ledger devices designed to install malware, according to previous reports.