- Cybercriminals are taking advantage of the recent Coldcard Mk3 security incident to launch a widespread phishing attack.
- In messages where senders impersonate the Ledger brand, fraudsters encourage people to migrate assets to an external Crypto.com Wallet using the sent seed phrase.
- The theft attempt is based on extorting access data, and the official technical support has never sent and does not send ready-made recovery words in e-mails.
A new wave of scams is taking advantage of the Coldcard incident
The e-mail presented in the scans allegedly comes from the official mailbox of the manufacturer Ledger and directly refers to authentic reports of problems with the random number generator in Coldcard Mk3 devices. In the text of the message, the attackers claim that integrations within the Ledger Live application used shared libraries associated with this framework. This is a manipulation designed to cause immediate panic in the recipient and make them follow instructions without verifying the facts.
The scam mechanism is based on the substitution of a ready-made set of keywords. The message included a specific twelve-word recovery phrase: “double rude tumble agent tribe april come object donkey denial stem trap.” The fraudsters allegedly partnered with the Crypto.com Wallet platform and instruct the recipient to import a given string of words into the new application and then immediately transfer all their digital assets there.
In fact, entering the given phrase or making a transfer to the address indicated in the message leads to the immediate loss of all resources. The described campaign is a clear example of a social engineering attack, in which the extortion is based on exploiting the fears of cryptocurrency holders after the well-publicized theft of almost 600 BTC from hardware wallets.
How to recognize fraud
A detailed technical analysis of this scheme reveals key incorrect assumptions that clearly point to a fake. No official manufacturer of hardware wallets, including Ledger or Crypto.com, sends ready-made seed phrases to its users in e-mails. The basic cryptographic principle of the Bitcoin network and the Ethereum network clearly states that each recovery phrase is created only locally on a physical, isolated user device.
The received e-mail contains navigation buttons leading to external sites and strictly requires you to take quick steps. Impersonating official technical communications is becoming more and more precise as fraudsters regularly monitor current market news and use sudden industry events to add credibility to their fake communications.
It should be noted that firmware and client applications are updated only from official programs downloaded from verified sources. Any request to import a foreign seed or send assets to an external address provided in an email constitutes an absolute fraud attempt.
Remember these simple rules
People who receive this type of message in their mailbox should delete it immediately without clicking on any links or downloading attachments. Official warnings and instructions regarding equipment safety are published by manufacturers only on their verified websites and on official social media profiles. No representative of digital asset companies asks for a seed phrase or sends ready-made keys in electronic messages.
To effectively protect your digital savings against social engineering attacks, it is essential to apply the following rules:
- Never enter your recovery phrase on devices with network access Private keys and seed phrases (sets of 12 or 24 words) should only go directly to the physical hardware wallet during its first configuration or when regaining access on a new device of the same type. Entering them on websites, mobile applications or e-mail forms means almost certain loss of funds.
- Verify news source and URLs: Phishing emails very often imitate official communications from well-known companies. Always check the message headers and the exact sender’s address. Remember, however, that the sender field can be faked, so never use links from emails – instead, enter the addresses of official websites manually in your browser.
- Remember that producers do not send ready-made seeds: An industry official will never create a new recovery phrase for a customer or send it as text in an email. The seed creation process takes place only on a secure chip (Secure Element) inside your hardware device.
- Ignore time pressure: Scammers create a sense of danger by claiming that your funds will be blocked or stolen if you do not respond within a few minutes or hours. If there are reports of security incidents, stop, verify the information with independent industry sources and do not make nervous moves.
- Use multisig setup for larger amounts: Splitting transaction authorization across several independent hardware devices from different manufacturers eliminates the risk of a single point of failure. Even if one of the keys is stolen as a result of fraud, criminals will not be able to withdraw funds without the remaining signatures.
Protection requires cold calculation
The entire described case shows that modern phishing is based on real industry events to build credibility and create time pressure. The attackers’ real goal is not to break the blockchain security, but to mislead the user and deceive access to his funds.
The weak link is still the human factor and haste in making decisions under the influence of emotions. A real attack often does not attack the source code itself, but rather the lack of information verification and lack of knowledge about basic security procedures.
Ultimately, the best line of defense against property loss is to strictly adhere to the principle of limited trust in messages sent by e-mail. Any reports of technical problems should always be verified in official manufacturer communications, remembering that the seed phrase is strictly confidential information and under no circumstances should it be entered in e-mail forms, on unknown websites or sent to third parties.
