From Inbox to Mailbox: Crypto Scams Go Physical With USPS

A new wave of phishing attacks is exploiting an old-fashioned delivery method: the US Postal Service.

Scammers posing as hardware wallet manufacturer Ledger are mailing counterfeit letters that urge recipients to “validate” their wallets—or risk losing access to their crypto funds.

The deceptive letters, flagged by BitGo CEO Mike Belshe, contain a QR code that likely directs victims to a phishing site designed to harvest private keys.

This marks a troubling evolution in phishing tactics, shifting from purely digital deception to physical social engineering.

Another recipient, Troy Lindsey, echoed the warning on social media, underscoring the growing threat posed by scams that leverage the perceived legitimacy of physical mail:

“These are all scams. Do not fall for any of these.”

The incident surfaces at a time of rising crypto-related fraud.

In April, blockchain sleuth ZackXBT confirmed that $330 million in Bitcoin had been stolen from an elderly victim—an elaborate scam traced to a UK-based call center.

More recently, Coinbase revealed it had been the target of a $20 million extortion attempt following a contractor data breach.

While the exchange claimed no wallet credentials or account access were compromised, leaked user names and contact details sparked concern.

TechCrunch founder Michael Arrington criticised Coinbase for downplaying the risks, warning that exposed customers could face real-world threats.

Fake Ledger Live Apps Spread Malware on macOS

Cybersecurity firm Moonlock issued a stark warning last week: macOS users are now the target of a sophisticated phishing campaign involving fake versions of Ledger Live, the widely used crypto wallet management app. h

These trojanised clones are designed to mimic the legitimate software so convincingly that they trick users into entering their 24-word recovery phrases through deceptive pop-ups.

According to Moonlock, this marks a significant escalation in crypto-targeted malware:

“Within a year, they have learned to steal seed phrases and empty the wallets of their victims.”

At the heart of the campaign is the Atomic macOS Stealer—a potent data-exfiltration tool capable of harvesting everything from passwords and notes to cryptocurrency wallet credentials.

The malware has been found embedded in at least 2,800 compromised websites.

Once installed, the malicious software silently replaces the authentic Ledger Live app with a counterfeit version.

It then pushes urgent-looking alerts prompting users to “verify” or “restore” their wallets.

The moment a user enters their recovery phrase, that critical data is transmitted directly to attacker-controlled servers.

This evolving attack vector underscores a troubling shift in crypto security threats—and a growing need for users to verify not just what they click, but where their software originates.