Brazilian Researcher Exposes Sophisticated Counterfeit Ledger Scam Operating on Chinese Marketplaces

A Brazilian cybersecurity researcher has blown the whistle on a highly organized counterfeit hardware wallet operation targeting crypto users seeking self-custody solutions. The discovery underscores just how far scammers will go to compromise private keys and drain funds from unsuspecting investors.

The Fake Ledger Scheme

Under the Reddit handle "Past_Computer2901," the researcher detailed their alarming experience purchasing what appeared to be a legitimate Ledger Nano S Plus from a Chinese marketplace at official pricing. The packaging looked genuine, the listing seemed legitimate—but once connected to the actual Ledger Live app, the device immediately failed the platform's built-in "Genuine Check" security protocol.

"This isn't meant to cause panic, but rather to serve as a serious warning — I'm honestly still a bit shaken by the sheer scale of this operation," the researcher stated. That reaction makes sense once you understand the sophistication level at play here.

How the Attack Works

Upon disassembly, the researcher discovered the device contained modified hardware and firmware specifically engineered to capture and expose sensitive wallet data. Here's where the social engineering gets particularly nasty: the counterfeit packaging includes a QR code designed to trick first-time hardware wallet users into downloading a malicious version of Ledger Live rather than the legitimate app.

Once victims follow the prompts on this fake application, the scammers gain access to seed phrases—the master keys to entire crypto portfolios. Game over.

The researcher identified several telltale signs of tampering, including scraped chip markings and an embedded WiFi and Bluetooth antenna. Legitimate Ledger hardware keeps private keys entirely offline, so this addition is a massive red flag that should immediately alert any sophisticated user.

Chinese Semiconductor Connection

Here's where it gets interesting from a crypto analysis standpoint. When the researcher examined the firmware by putting the chip into boot mode, it initially identified as a Nano S Plus. But once the boot sequence completed, another manufacturer surfaced: Espressif Systems, a publicly listed Chinese semiconductor company based in Shanghai.

The presence of Espressif's signature suggests either direct involvement or sophisticated supply chain compromise. Cointelegraph reached out for comment but received no immediate response.

A Growing Threat Landscape

This fake Ledger operation isn't happening in isolation. Earlier this month, over 50 victims fell victim to a malicious Ledger Live app that somehow made it through Apple's App Store vetting process via a bait-and-switch strategy. Those users collectively lost $9.5 million before Apple removed the fraudulent application.

The broader pattern: scammers are escalating their sophistication, combining supply chain attacks, social engineering, and approval scams to target self-custody advocates. For portfolio holders moving away from centralized exchanges, hardware wallets represent critical infrastructure—and that makes them increasingly attractive targets.