Hardware Wallet Scams: Fake Devices, Fake Support, Fake Apps

Almost everyone who loses crypto while using a hardware wallet is scammed, not hacked. The device does its job — it keeps the key offline — so attackers go after you instead: tricking you into revealing your recovery phrase, approving a malicious transaction, or buying a compromised device. The good news is that these scams follow a handful of predictable patterns, and once you know them they're easy to refuse. The golden rule underneath all of them: your recovery phrase is never entered anywhere but the device, and no one legitimate will ever ask for it.

Fake support and impersonation

The most common scam is fake support. You post a problem in a forum, a Discord, or a social reply, and a helpful "support agent" messages you within minutes. They walk you through a fix that, at some step, asks you to enter your recovery phrase into a website or a "wallet validation" tool — and that's the theft. Real hardware-wallet companies do not DM you first, do not have support in random chat channels, and never need your seed phrase. Treat any unsolicited "support" contact as hostile, and only ever reach a company through the official website you typed yourself.

Phishing emails and letters — the Ledger breach fallout

Phishing is the delivery mechanism for most seed-phrase theft, and one event supercharged it. In 2020, Ledger's e-commerce and marketing database was breached, exposing around a million emails and roughly 272,000 detailed records — names, addresses, phone numbers. No device or funds were touched, but the leaked contact data fuelled years of frighteningly specific phishing: emails, texts and even physical letters that address you by name and claim your wallet is "at risk" or needs a "security update," driving you to a fake site to enter your phrase. The lesson generalises to every brand: a message that creates urgency and asks you to verify, migrate, or re-seed your wallet is a scam, no matter how personalised it looks.

Fake apps and browser extensions

Counterfeit wallet apps and extensions appear constantly in app stores, search ads and web-store listings, often outranking the real one. Install a fake companion app and it may ask you to "import" your wallet by typing the seed phrase — game over. Download software only from the manufacturer's official website, typed by hand, and be sceptical of the top search-ad result, which is a favourite place for imposters to buy their way to the top. Check reviews and developer names, and if an app ever asks for your recovery phrase to "set up" a hardware wallet, close it.

Address-swap and blind-signing traps

Some attacks don't need your seed at all — they trick you into signing away funds yourself. Clipboard-hijacking malware silently swaps a copied receiving address for the attacker's, so you send to the wrong place; "address poisoning" seeds your transaction history with a lookalike address hoping you'll reuse it. And malicious dApps ask you to approve a transaction that grants sweeping token permissions. The defences are on the device: always verify the receiving address on the wallet's own screen, character by character, not just in the app, and never "blind sign" a transaction whose details you can't read and understand.

Fake devices and "free" wallets

Then there are the physical scams: counterfeit or pre-initialised devices sold on marketplaces, and the notorious "you've been sent a free hardware wallet" package — sometimes mailed to breach victims — that comes with instructions to use a supplied recovery phrase the scammer controls. Never use a device you didn't buy new and direct, and never use a recovery phrase that came with one. We cover this end to end in buying direct vs marketplace.

If you think you've been targeted

If you've entered your seed phrase anywhere you shouldn't have, act immediately: set up a new wallet with a fresh seed and move your funds before the attacker can, exactly as described in our seed-phrase guide. If you're still choosing a device, our best hardware wallets page links only to official stores. Slow down, verify on the device, and no scam on this list can touch you.

Build a scam-proof routine

The reliable defence against every scam on this page isn't cleverness in the moment — scammers are good at the moment — it's a routine you follow without thinking. Type wallet and exchange addresses in yourself and use bookmarks rather than clicking links from messages or search ads. Treat any unsolicited contact about your wallet, in any channel, as hostile by default. Verify every receiving address on your device's own screen before sending. And hold one rule as absolute: the recovery phrase is entered only on the device, only during a genuine restore, and never anywhere else for any reason.

Slowing down is itself a defence, because urgency is the common thread. Almost every scam needs you to act fast — before you think, before you check, before the "deadline." A legitimate situation with your own self-custodied crypto is never urgent in that way; nothing bad happens because you took an hour to verify. If a message, call or pop-up is pressuring you to hurry, that pressure is the tell, and the correct response is always to stop and independently check through a channel you trust.