Implant victims get targeted twice

The implant took your coins. The second wave is an industry that hunts people who already lost — fake Ledger support, fake recovery agents, and fake "victim intake" sites built to harvest the same phrase the implant already stole. This page is the pattern, so it doesn't get you.

The rule that decides everything

Your 24-word recovery phrase is the money. The implant stole it off your screen. Everything in this second wave is designed to get you to type it, say it, photograph it, or "verify" it one more time. Ledger will never ask for it. Police will never ask for it. Lawyers will never ask for it. This site will never ask for it — our intake form is hard-coded to reject seed-shaped text in your browser before encryption. Any site that accepts it is the scam.

Red flags — any one is enough

"Ledger support" contacts you first. Real Ledger support does not cold-call, cold-DM, or cold-email about the implant. Fake support accounts on X, Telegram, WhatsApp, and WeChat are already running. Ledger only communicates through support.ledger.com tickets that you open.

A "victim registry" or "compensation portal" asks for your phrase. Several are live, some cloned from real claimant sites pixel-for-pixel. A legitimate intake never needs your phrase — it needs your purchase channel and your txids. If a form accepts 24 words, close the tab.

"Verify your device is clean" by entering the phrase. There is no such tool and cannot be — checking a phrase reveals it. Variants: " Ledger Authenticator," "firmware verification," "seed checker."

A recovery agent guarantees results for upfront crypto. Real recovery rates for reported crypto theft are in the single digits. Regulated professionals bill in fiat or take contingency. USDT to a personal wallet is your last money leaving.

A dashboard shows "your traced funds." The balance is stagecraft. The next "unlock fee" or "tax" or "anti-money-laundering deposit" is real — and there will always be one more.

Remote-access software. "Let me check your device remotely" = install AnyDesk/rustdesk = they watch you type everything. Police and counsel never need screen access to your machine.

Urgency and secrecy. "Freeze window closes in 24 hours," "don't tell your family/bank." Pressure exists to stop you doing exactly what this page says.

A QR code or short link. Implant-victim phishing arrives by letter, SMS, and video QR codes. Type addresses yourself. When in doubt, the only trustworthy URL is one you reached by typing the domain yourself.

What legitimate help actually looks like

You initiate, always. Ledger support via a ticket you opened. Police via a report you filed. Counsel via an engagement letter you signed. Nobody legitimate finds you first.

SEAL 911 for live drains. If funds are moving right now, the Security Alliance runs a free emergency channel — see emergency contacts. They never ask for your phrase either.

Issuer freezes happen through police reports. Tether froze ~$10M in this incident — that happened because victims filed reports fast, not because anyone paid a "freeze fee."

This site's own rules. Sealed intake — ciphertext only, you hold release. Nobody from this project will ever DM you first, ask for your phrase, or charge to file. If someone claiming to be us does — it's the scam described above.

If you already gave your phrase to someone

Assume every wallet under that phrase is empty or will be. Move anything remaining to a fresh seed on a clean device now — not the compromised device. Then file reports: the thief is identifiable at exchanges. See emergency contacts for your jurisdiction.