Fake Ledger pages near the top of Google search go after wallet recovery phrases
Fake Ledger sites in Google results are asking for recovery phrases while Ledger probes losses researchers put above $86 million. Nothing yet ties that sum to the pages, but the way the campaigns were built makes a top search result a working route into self-custody wallets.
The Investor · Invest desk
Wallet owners: anyone with the recovery phrase can recreate the wallet without the hardware. Searchers for Ledger terms: fraudulent ads targeted the U.S., Europe and parts of Asia. Google search users: the fake site sat near the top of results, before Ledger's official site.
- exposure Ledger wallet owners Anyone with the recovery phrase can recreate the wallet in compatible software, without the original hardware, claim 13
- exposure Searchers for Ledger terms Fraudulent ads targeted Ledger-related searches in the U.S., Europe and parts of Asia, claim 7
- exposure Google search users The fake site appeared near the top of Google results, where users could meet it before reaching Ledger's site, claim 15
| Who | How | Kind | Claim |
|---|---|---|---|
| Ledger wallet owners | Anyone with the recovery phrase can recreate the wallet in compatible software, without the original hardware | exposure | 13 |
| Searchers for Ledger terms | Fraudulent ads targeted Ledger-related searches in the U.S., Europe and parts of Asia | exposure | 7 |
| Google search users | The fake site appeared near the top of Google results, where users could meet it before reaching Ledger's site | exposure | 15 |
What happened
- Researcher Cyber Scrilla found Ledger-branded Google search results leading to a fake site and app, Bitcoin News reported on October 10.
- That site displayed a claim of more than 1 million visits over 30 days, a figure never confirmed as traffic to the malicious domain.
- Zscaler ThreatLabz had published a September 25 investigation into a separate campaign that used fraudulent Google ads to collect Ledger recovery phrases.
- No verified victim count or stolen amount exists for the newly reported site, and it is unconfirmed whether it shares Zscaler's infrastructure.
Why it matters
- exposure An owner who types the 24-word phrase into one of these pages loses the wallet itself, because the phrase rebuilds it in other software and the device's key protection never comes into play.
- constraint Redirects that rotate three to four times an hour leave address blocklists chasing 72 to 96 fresh URLs a day, so filtering by address alone lags the campaign.
- decision Advisers on self-custody can no longer read a verified advertiser account or a large visit count on an ad as evidence that a wallet result is genuine.
- contradiction Until losses are traced, the $86 million cannot be counted as a cost of search-ad phishing, so the money attached to this specific route is still unmeasured.
The pages ask for the recovery phrase because it is the one credential that works without the hardware. A Ledger device keeps private keys inside the physical unit, but anyone holding the 24-word phrase can rebuild the wallet in compatible software without the device [13]. The fake page Zscaler found offered downloads for Windows, macOS, Linux and mobile, then took visitors through what looked like a standard setup [10]. The October site sat near the top of Google results, where a searcher could reach it before Ledger's official site [15].
Several of the trust signals in Zscaler's case came from Google. The ads ran through a Google-verified advertiser account and targeted Ledger searches in the U.S., Europe and parts of Asia [6][7]. One ad showed more than 1 million monthly visits beside a google.com address, and Zscaler said the count appeared to refer to Google itself; crypto.news notes the number could have made the ad look more trustworthy [11]. Clicks then went through Google Cloud Storage and Vercel to a fake Ledger page on Google Sites [8]. The Vercel addresses changed roughly every 15 to 20 minutes [9]. A blocklist keyed to addresses would face three to four new ones an hour, or 72 to 96 a day [16].
The October report can resolve in three ways. If Cyber Scrilla's site is the campaign Zscaler documented, Zscaler's September 25 report did not stop it, since Bitcoin News reported the new site 15 days later [17]. If it belongs to a separate operator, the method has been copied. Or the $86 million may trace to something with no search component at all, since crypto.news ties Ledger's probe to CryptoBilis customers and does not say how those losses happened [2].
In all three cases, we think, a top Google result for a wallet maker's name, paid or organic, is a route attackers are already using, and anyone holding or advising on self-custody should treat it as unverified. The counter-thesis is about size. If traced losses from these pages come in small next to the CryptoBilis losses, the ads are a real but minor risk and the large sum was taken some other way. A traced breakdown of the $86 million showing few search-ad victims would make that case.
The defence on record sits with the customer. Ledger advises users never to type the 24-word phrase into a website or a downloaded application [14].
What to watch
- A traced breakdown of the $86 million estimate showing how much, if any, reached attackers through search-ad phishing pages.
- Confirmation that Cyber Scrilla's site shares Zscaler's infrastructure would show the campaign survived its own public disclosure.
- A verified traffic count for the October phishing domain to replace the unconfirmed 1 million visit claim.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence55
- Adoption
- Insufficient
- Hype gap+20
- Incentives
- Insufficient
- Confidence50
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Security researchers warned that a fake Ledger website and application appeared prominently in Google search results, attempting to steal cryptocurrency wallet recovery phrases.
- [2]
Ledger is investigating suspected losses involving CryptoBilis customers, while researchers estimate over $86 million stolen.
- [3]
Bitcoin News reported on October 10 that security researcher Cyber Scrilla had identified fraudulent Ledger-branded search results directing users toward a fake website and application.
- [4]
The impersonation campaign reportedly displayed a claim of more than 1 million visits over 30 days, a figure not independently confirmed as traffic to the malicious website.
- [5]
In a September 25 investigation, Zscaler ThreatLabz documented a separate campaign using fraudulent Google advertisements to collect Ledger recovery phrases.
- [6]
Zscaler researchers first examined the campaign in August 2026 and identified advertisements operating through a Google-verified advertiser account.
- [7]
The advertisements targeted users searching for Ledger-related terms in the U.S., Europe and parts of Asia.
- [8]
After users clicked an advertisement, attackers directed them through Google Cloud Storage and Vercel before displaying a fake Ledger page using Google Sites.
- [9]
During the investigation, the Vercel redirect addresses appeared to change approximately every 15 to 20 minutes.
- [10]
The fake page resembled Ledger's official wallet interface and presented download options for Windows, macOS, Linux and mobile devices, instructing visitors to follow what appeared to be a standard setup procedure.
- [11]
A malicious Google advertisement in Zscaler's investigation showed more than 1 million monthly visits alongside a google.com address; Zscaler said the figure appeared to refer to Google itself, and the visit count could have made the advertisement appear more trustworthy.
- [12]
No verified victim count or amount stolen has been established for the newly reported phishing website, and the evidence does not confirm whether it concerns the same infrastructure Zscaler investigated.
- [13]
Ledger hardware wallets keep private keys protected within a physical device, but anyone who obtains the associated recovery phrase can recreate the wallet through compatible software without the original hardware.
- [14]
Ledger advises users never to type their 24-word recovery phrase into websites or downloaded applications.
- [15]
According to Cyber Scrilla's reported findings, the fraudulent website appeared near the top of Google search results, where users could encounter it before reaching Ledger's official website.
- [16]
Redirects changing every 15 to 20 minutes produce three to four new addresses an hour, or 72 to 96 a day.
- [17]
Bitcoin News reported the new fake site 15 days after Zscaler published its investigation.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
1 independent publisher whose own reporting we read for this story.
- crypto.newsLedger faces fake website warning amid $86M theft probe
1 article · October 10, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- Crypto Wallet PhishingFollow
- Self-custodyFollow
- MalvertisingFollow