The U.S. Attorney’s Office for the District of Connecticut has recovered and forfeited more than $600,000 in cryptocurrency connected to a fraud scheme targeting a hardware wallet user. The case stems from a phishing incident in September 2025, in which a Connecticut resident was deceived by a letter falsely claiming to be from Ledger Security & Compliance. The letter instructed the recipient to complete a mandatory security check, but following those instructions instead allowed fraudsters to compromise the user’s hardware wallet.
The scam resulted in the theft of $234,000 in cryptocurrency from the victim. Investigators from the FBI and Connecticut State Police tracked the movement of the stolen funds, ultimately enabling the seizure of approximately $600,000 in the USDT stablecoin. A civil forfeiture complaint was filed alleging the funds represented proceeds of wire fraud and money laundering.
The incident fits a broader pattern of phishing campaigns that use physical mail rather than digital channels to target owners of crypto hardware wallets. A recently identified campaign sent fake postal letters to owners of Trezor and Ledger devices, complete with company logos, holograms, and QR codes directing recipients to fraudulent websites. Cybercrime consultant David Sehyeon Baek previously told Decrypt that this shift to physical mail exploits the credibility of the postal system, noting that a letter bearing a recipient’s name and home address triggers a stronger sense of alarm and compliance.
These schemes have been facilitated in part by a series of data breaches at hardware wallet manufacturers over recent years. A 2020 breach of Ledger’s e-commerce platform exposed more than one million email addresses, and a separate incident in January 2026 at a Ledger e-commerce partner compromised customer order data. Rival manufacturer Trezor has also experienced data exposure, including a 2022 insider exploit involving MailChimp and a later breach of a third-party support portal that affected roughly 66,000 users.
Those breaches have provided scammers with the personal information needed to craft convincing, targeted correspondence. The availability of names and home addresses makes physical mail campaigns particularly effective, as recipients may assume the sender has legitimate knowledge of their identity and holdings. Ledger did not immediately respond to a request for comment on the Connecticut case.
Federal and state authorities have pursued several significant cryptocurrency forfeiture actions in recent months. In one separate case, prosecutors sought forfeiture of $200,000 in USDT connected to a so-called pig butchering scam conducted through Tinder. In another, Florida authorities seized $1.5 million in Dogecoin, Pepe, and Solana tokens in a case involving a Chinese national.
Originally reported by Decrypt.
