flash on Nostr: ⚡️🚨 NEW - Ledger customers are receiving physical scam letters impersonating a ...
⚡️🚨 NEW - Ledger customers are receiving physical scam letters impersonating a "Quantum Resistance" security update signed by CTO Charles Guillemet.
There's a QR code that leads to a phishing site harvesting 24-word recovery seed phrases.
Letters are localized per region (Italian recipient in the wild got an Italian-language version, matching Global-e's cross-border checkout data).
The data is probably sourced from the January 2026 Global-e breach (Ledger's e-commerce processor).
Published at
2026-05-16 19:44:30 UTCEvent JSON
{
"id": "b56603d73fcabf6ee79d3231b7c39193649909459f3f6e0f3490fafe9e4af2cb",
"pubkey": "4d7842051782e0d3feb034d150adc2b6bae4ee3b49786793bffa468b6f5b96b3",
"created_at": 1778960670,
"kind": 1,
"tags": [
[
"imeta",
"url https://blossom.primal.net/2d6f831b19fb4c6d110bee09641c5d7b39fc20811a2573f71b3526e690f9a2e7.jpg",
"m jpeg",
"dim 1536.0x2048.0"
],
[
"imeta",
"url https://blossom.primal.net/31253a716c181f9b59938ae6db22573c935bfbe39ccdb3e44c0c72833f580eda.png",
"m png",
"dim 1360.0x1360.0"
]
],
"content": "⚡️🚨 NEW - Ledger customers are receiving physical scam letters impersonating a \"Quantum Resistance\" security update signed by CTO Charles Guillemet. \n\nThere's a QR code that leads to a phishing site harvesting 24-word recovery seed phrases. \n\nLetters are localized per region (Italian recipient in the wild got an Italian-language version, matching Global-e's cross-border checkout data). \n\nThe data is probably sourced from the January 2026 Global-e breach (Ledger's e-commerce processor).\nhttps://blossom.primal.net/2d6f831b19fb4c6d110bee09641c5d7b39fc20811a2573f71b3526e690f9a2e7.jpg\nhttps://blossom.primal.net/31253a716c181f9b59938ae6db22573c935bfbe39ccdb3e44c0c72833f580eda.png",
"sig": "4fe4392796ce4650d362ee05247b72019d4177c86ab58d1977ea03adcf27390fe5acaafe35eefa20776f9fcb54dddddf4fc3301bd3d0a484d31b18790a89ce59"
}
