Fake Ledger wallet: the scams, the props, and how to tell them apart in ten seconds

The phrase covers two things that could not be further apart: fake apps, sites and support accounts built to take a recovery phrase, and harmless screens drawn for a video. One empties wallets. The other holds nothing. Here is how each works, the tells that separate them, and the single rule that makes the distinction obvious.

Published: 14 November 2026

Two opposite things, one phrase

Search this phrase and the results split cleanly down the middle, though the search engine cannot tell you which half you are looking at.

On one side: counterfeit apps, browser extensions, lookalike sites, emails and support accounts, all built around a single objective, which is to get hold of a recovery phrase or a signature from a wallet that holds real money. They are patient, well made, and increasingly hard to spot by appearance alone.

On the other side: props. Screens drawn to look like a wallet app, filled with numbers somebody typed, used for videos, skits, tutorials, decks and product demos. They hold nothing and can take nothing.

The rest of this page is about telling them apart quickly, because the cost of getting it wrong is entirely one-sided.

How the dangerous version works

Every variant converges on the same request. The variety is in the approach.

The counterfeit application

An app that carries the brand name and the logo, found in a store listing or behind a sponsored search result. It walks you through what looks like setup and, at some point, asks you to enter your existing recovery phrase to import or restore an account. That request is the attack. Everything before it is staging.

The browser extension

The most dangerous shape, because an extension sits inside the browser with access to the pages you open. A fake one can show a convincing interface and wait for the moment you type something worth stealing, or quietly alter what a page shows you before you approve it.

The support account

You post a question about a wallet problem in a public forum or a chat server. Within minutes, help arrives: a friendly account with the right avatar, a form to fill in, a "verification" step. Real support does not come to you first, and does not need those words at any point.

The breach notice

An email saying your data was exposed and your device must be verified. It works because it is plausible, urgent and specific, and because enough real incidents have happened in this industry that the story does not sound invented. The link is the attack. Nothing about a genuine breach ever requires entering a recovery phrase anywhere.

The signature request

A newer shape, and one that catches careful people. No phrase is requested at all. Instead you are asked to connect a wallet and approve something that looks routine, while what you are actually approving grants ongoing access to your assets. Read what you sign, and be suspicious of approvals that do not match the action you expected.

The tells, in order of reliability

1. It wants the 24 words. Decisive, every time, with no exception worth entertaining. Stop there.
2. It came to you. Unsolicited help, unsolicited notices, unsolicited urgency. Attacks arrive; tools are gone looking for.
3. It needs installing to show you a picture. A drawn screen needs no install, no pairing and no permissions. An install request for a cosmetic result is a request for access.
4. The urgency is manufactured. Funds at risk, action required today, verify now. Real problems with a hardware wallet are rarely urgent, because the keys do not move on their own.
5. The address is nearly right. A character swapped, a different ending, a subdomain that reads correctly at a glance. Type addresses yourself for anything that touches money.

The harmless version, and why it exists

The other half of the search is people who need a screen, not access. A creator filming a tutorial, a founder presenting a product with no users yet, a designer showing a feature in context, a comedian doing a sketch about crypto. All of them need an interface with plausible contents and none of them need a wallet.

A prop built for that has a specific shape: it runs in a browser or an app, it asks for assets and amounts, it draws the screens, and at no point does the word "recovery" appear. It cannot take anything because it is not connected to anything. That is not a promise about intentions, it is a description of the mechanism.

The honest ones also make the image identifiable as a mockup when it leaves its context, because a prop that travels without its context is exactly the raw material a scam wants.

If someone shows you one

Turn the question around. The important thing is never whether the screenshot looks real, because screenshots are easy. The important thing is what is being asked of you off the back of it.

A balance screen attached to a request for money, an investment, a loan, a partnership or trust should be treated as carrying no information at all. It is an image produced by the person asking. Whatever it shows, it tells you nothing about what they hold, and the effort put into making it convincing is not evidence of anything except effort.

What we make, stated plainly

Flexdger Wallet is the harmless kind. It draws wallet app screens from the assets and amounts you enter, in a browser, for videos, decks and demos. It connects to no device and no chain, it has never had a reason to ask for a recovery phrase, and it never will, because a drawing has no use for one. You can try the interface without an account.

We are not affiliated with Ledger, and nothing here is endorsed or reviewed by them. If you are here because something asked you for your 24 words: it was an attack, whatever it claimed to be, and no tool that merely draws a screen would ever have needed them.