Fake Ledger site tops Google results, draws over 1 million visits
Regulation & Gov ·
A fraudulent Ledger phishing website and app surfaced at the top of Google Search results, logging more than 1 million visits in the past 30 days while prompting users to hand over their 24-word recovery phrases.
The site was identified by security researcher Cyber Scrilla, according to a report. Google's own search traffic data reportedly shows the page crossed the 1 million-visit mark over the trailing month, a figure that underscores how effectively the fake listing has embedded itself ahead of legitimate results. The phishing page mimics Ledger's branding closely enough to convince visitors to input their seed phrase, the single credential that grants full access to a crypto wallet's holdings.
The discovery comes as investigators continue probing an estimated $86 million in wallet thefts tied to a Southeast Asian hardware reseller known as CryptoBilis, a case referenced alongside the phishing find in the same cluster of reporting. While the two matters are being tracked together, the material does not establish a direct operational link between the CryptoBilis thefts and the Google-ranked phishing site itself.
This is not an isolated incident involving Ledger's name. A September investigation by cybersecurity firm Zscaler had already flagged malicious Google ads impersonating Ledger, which redirected users to fake wallet-verification pages designed to harvest credentials. The recurrence of Ledger-themed phishing across both paid ads and organic search results points to a sustained effort to exploit the brand's recognition among hardware-wallet users.
Two distinct sources have now covered the cluster, with the Google ranking of the fake site prompting particular concern because top organic placement can lend an attacker's page a false sense of legitimacy that paid ads sometimes lack. Neither the exact mechanism by which the fraudulent site achieved its search ranking nor the scale of financial losses attributable specifically to this phishing page has been disclosed.
What remains unresolved is whether Google has removed or demoted the site following the researcher's disclosure, and whether any funds have been confirmed stolen through it. The relationship, if any, between this phishing operation and the CryptoBilis-linked thefts also has not been clarified.