Ledger warns of a phishing campaign using letters and a QR code to steal seed phrases

Ledger reports an ongoing campaign: holders receive physical letters with a QR code leading to a fake website that asks them to enter their 24-word recovery phrase. Entering the phrase gives attackers full access to the wallet and leads to loss of funds. Ledger stresses that the company never contacts users by DM, phone or mail, and never asks for a recovery phrase.