Got a letter from Ledger or Trezor: what is this?

How to recognise such a letter

The letter gives an urgent reason: a security problem, a mandatory update, a check of your details. It contains a QR code or a link, and the request to enter your recovery phrase (your 24 words) or to ‘validate’ your wallet. The letter can look official, with a logo, letterhead, a signature and sometimes your name and address. None of that means anything: the request for your words is the giveaway.

What is going round now (as of October 2026)

Letters ‘Transaction Check’ / ‘Authentication Check’ (since late 2025): addressed to you by name, sometimes with a hologram or a signature, with a date one or two weeks ahead. The QR code leads to a copied website that asks for your recovery phrase, ‘to confirm the device is yours’.

Letters ‘Post-Quantum Security Update’ (since June 2026): a ‘mandatory security update against quantum computers’, with a deadline and a QR code ‘generated from your reference number’. No such update exists as a letter; Ledger itself called the letter a scam.

Emails ‘firmware update’ (since October 2026): in October 2026 it came out that tampered Ledger devices had been sold through one reseller. Emails ride on that news: ‘update your firmware now’, with a link to a page that ‘checks’ your device and asks you to connect it or enter your words. A real update only shows in Ledger Live or Trezor Suite, on the device itself.

In all three forms the request is the same: your recovery phrase, or connecting your device to an unknown page. Ledger and Trezor never ask for that, not for a check or an update either.

Why they have your address

Customer names and addresses sometimes leak from an online shop. That the letter knows your name therefore does not mean it comes from the company. It only means your details leaked somewhere. In September 2026, for example, Trezor reported that names, email addresses, phone numbers and addresses of customers in the US had been exposed at a shipping partner. After such a leak, emails and phone calls that know your name and your order can follow as well.

What you can do

Do not scan the QR code with your camera app. It opens the link straight away. Do not type anything on a page from a letter either.

Want to check whether something is really going on? Type the official address yourself: ledger.com or trezor.io. A real update only comes through the device’s own app (Ledger Live, Trezor Suite) on the device itself.

You can report it. To the company itself through its official site, and to the police or your country’s fraud-reporting service.

Checking a link from the letter. Type it over and send it to the Telegram bot @Veydor_check_bot. It compares the address with the official addresses and opens nothing.

The letter can go in the bin. There is nothing else you need to do with it.

Your words are all that matters

Your recovery phrase belongs only on the device itself and on the paper or metal where you keep it. Whoever has your words has your coins. No company needs them, for any update, check or recovery.