A Google-Approved Phishing Scam Is Targeting Ledger Wallet Users, Here’s How To Stay Safe

Here’s a sentence that should stop anyone with a hardware wallet in their tracks: as of this week, typing “Ledger Wallet” into Google doesn’t reliably take you to Ledger.

Instead, the top result in some searches is a paid, sponsored ad labeled “Ledger Official” that leads straight to a phishing page, hosted, ironically, in a way that borrows Google’s own credibility to make the scam look real. I’ve seen plenty of crypto phishing attempts dressed up to look convincing, but this one is different, because the platform doing the vouching isn’t some sketchy ad network. It’s Google itself.

The alarm was raised by Da Hongfei, founder of the Neo blockchain, who called the situation “seriously dangerous” and tagged both Google Ads and Ledger directly, demanding the ad be pulled.

Why A Sponsored Google Result Is So Dangerous Here

To understand why this particular scam is worth taking seriously, you have to understand what makes it different from a typical phishing email or a fake app buried in an obscure download site. Da Hongfei laid out three specific reasons the ad is unusually effective, and I think each one deserves its own weight.

First, Google itself approved the ad as a sponsored placement, meaning the platform’s own verification process let it through. Second, the domain visible to the user in the search results is google.com, not some suspicious lookalike URL, so anyone glancing at the address bar sees exactly what they’d expect from a legitimate search. Third, the destination page closely mimics Ledger’s actual website, right down to branding cues that make it feel authentic to anyone who isn’t scrutinizing every pixel.

Put those three together, and you get what Da Hongfei described as a “dangerous trust ambiguity.” Google effectively allowed a third party to publish content under its own domain and then advertise that content as “Ledger Official,” which strips away the two things people usually rely on to spot a scam: an odd URL and an unofficial-looking landing page. Neither red flag was present here.

How Fake Ledger Software Has Already Cost Victims Millions

This isn’t the first time fraudsters have leaned on Ledger’s brand trust to empty people’s wallets, and I think it’s worth laying out just how often this has happened recently, because the pattern says a lot about how sophisticated these campaigns have become.

Earlier this year, a fraudulent “Ledger Live” application made it onto Apple’s App Store and sat there long enough to drain more than $9.5 million from over 50 victims across Bitcoin, Ethereum, Solana, Tron, and XRP between April 7 and April 13. Victims entered their recovery phrases into the fake app believing they were restoring or verifying a legitimate wallet, handing attackers full control the moment they typed those words in. The stolen funds were reportedly funneled through more than 150 deposit addresses tied to a centralized laundering operation before Apple pulled the app, only after the damage was already done.

That wasn’t an isolated incident either. Ledger’s own security team maintains a running list of active phishing campaigns targeting its users, covering everything from fake firmware update emails to fraudulent physical letters mailed to people’s homes, complete with forged logos and reference numbers designed to look like official correspondence.

What Ledger Has Said About Protecting Its Users

Ledger has been fairly consistent in its messaging on this front, and I think it’s worth repeating in plain terms because it’s the one piece of advice that actually holds up across every version of this scam: the company will never ask for a 24-word recovery phrase, under any circumstance, through any channel. Ledger states clearly that the only place to download its official software is directly from its own website, and it actively encourages users to report suspicious communications, whether that’s a fake email, a fake call, or now, apparently, a fake sponsored search result, to its dedicated phishing reporting address.

That guidance hasn’t changed. What’s changed is where the fake page is showing up, and that’s exactly what makes this incident feel like a new front in an old war.

The Bigger Pattern Behind This Scam

I don’t think it’s a coincidence that this is happening at the same time hardware wallet scams have been escalating across nearly every distribution channel imaginable, app stores, Discord servers, physical mail, and now paid search ads. Each version of the scam exploits a different layer of trust: the app store’s review process, a community platform’s moderation, the postal system’s legitimacy, and now, Google’s own advertising verification. Attackers aren’t inventing new tricks so much as they’re systematically working through every trusted surface a Ledger user might encounter and finding the weakest link in each one.

What This Means For Anyone Searching For Ledger Right Now

If there’s one takeaway I’d want anyone reading this to walk away with, it’s this: don’t trust a sponsored label, a familiar-looking domain, or a polished landing page to do the verifying for you. Type ledger.com directly into your browser rather than clicking through a search result, sponsored or otherwise, and never, under any circumstance, enter a recovery phrase into a website, app, or form that a legitimate hardware wallet company would never ask for in the first place.

Google Ads and Ledger have both been publicly tagged and asked to act. Until there’s confirmation the ad has been removed, the safest assumption is that the fake “Ledger Official” result may still be live for some searches, which, given everything Ledger users have already been through this year, is exactly the kind of gap attackers are counting on.

Disclosure: This is not trading or investment advice. Always do your research before buying any cryptocurrency or investing in any services. 

Follow us on Twitter @themerklehash to stay updated with the latest Crypto, NFT, AI, Cybersecurity, and Metaverse news!