Ledger users are now receiving physical scam letters at their home addresses. This goes beyond phishing emails.

Data from both the 2020 Ledger breach and a January 2026 third-party breach through Global-e is being used to target users with fake "firmware update" letters containing QR codes designed to steal seed phrases.