Owning a hardware wallet is supposed to mean the seed phrase never touches an internet-connected device. Attackers have adapted to that assumption directly, building an entire category of scam around the one moment a hardware wallet owner is trained to expect an official-looking prompt: a firmware update.
How the fake prompt actually reaches someone
These campaigns usually arrive through one of three channels. An email, sometimes sent to an address harvested from a past data breach involving a hardware wallet retailer, claims a critical security update is required and links to a page that closely mimics the manufacturer’s real site. A fake application, distributed through an unofficial download link or occasionally slipping past review on a third-party app store, presents itself as the manufacturer’s companion software. Or a spoofed website, reached through a paid search ad or a typosquatted domain a few characters off from the real one, walks a visitor through a fake "update wizard." Each version converges on the same goal: getting the victim to either type their recovery seed into a web form under the pretense of "verifying" the wallet before the update, or to install a modified firmware file that silently exposes the private keys once installed on the real device.
Why this works even on cautious users
The approach specifically exploits security-conscious behavior rather than carelessness. Someone who already knows never to store a seed phrase digitally can still be talked into entering it "just this once" if the request is framed as a mandatory security step rather than a normal transaction. The urgency is usually manufactured, warnings about an active vulnerability, a compliance deadline, or a claim that funds are at risk until the update completes, which pushes the decision to be made quickly rather than verified carefully.
No legitimate hardware wallet update, from any manufacturer, ever requires entering a recovery seed phrase into a website, an app, or any digital field of any kind. A prompt asking for the seed phrase to "confirm," "verify," or "restore" a wallet before an update is proceeding is the single clearest sign the update is fraudulent.
How to verify an update is genuine
- Never follow a firmware update link from an email, text message, or search ad. Navigate to the manufacturer’s website by typing the address directly or using a saved bookmark from before the update prompt appeared.
- Confirm any update prompt actually appears on the hardware device’s own screen, not just in a browser tab or a companion app window. Genuine firmware updates require a physical confirmation on the device itself.
- Check the update against the manufacturer’s official release notes or support channel before installing, and treat a version number or release date that does not match published information as a red flag.
- Verify the device displays the manufacturer’s standard cryptographic verification step during the update, most legitimate hardware wallets check the firmware’s digital signature automatically and will refuse to install anything unsigned or tampered with.
- If in doubt, disconnect and contact the manufacturer’s official support channel directly before proceeding, rather than continuing through an update flow that feels rushed or unfamiliar.
The broader pattern is worth remembering even outside firmware specifically: any request to type a recovery phrase into a screen, regardless of how official the surrounding interface looks, is the request to stop and verify independently before doing anything else.