- A user claimed that his life savings in crypto were drained by a top-sponsored Google ad that impersonated Trezor’s official site.
- Reports and on-chain data show that the victim lost over 24 BTC from the phishing attack.
A user recently aired his grievance after supposedly losing his life savings from a Trezor hardware wallet. To Trezor’s credit, though, the vulnerability was due to a phishing attack rather than hardware failure like the controversy hounding Coldcard.
Phishing Attack From Fake Trezor Sites
On Thursday evening (UTC), a pseudonymous X user named David claimed he had lost all his life savings in crypto. It stemmed from a website that he accessed, which was actually linked to a bogus site impersonating Trezor.
The user lost access to all his funds upon entering his seed phrase on the fake site. On-chain data reveals that the attacker stole over 24 Bitcoin (BTC) from the phishing activity.
The fake site gained David’s trust because it was a top-sponsored result when searching using the phrase “Trezor wallet” on Google. The attacker had shut down the site to cover his tracks as the event gained widespread attention. Meanwhile, the perpetrator immediately laundered the loot from the harvesting address.
Trezor’s Response
Trezor directly responded to David, but it could only sympathize with him. After all, it had no part or fault in the incident. The theft stemmed solely from a user’s mishap, specifically his failure to verify the link where he entered his crypto wallet credentials.
Nonetheless, the company thanked the user for flagging the site and the address of the culprit. It also assured the victim that its team has escalated the matter internally and is reporting the phishing page through relevant channels.
Trezor advised users to only interact with its official website. Additionally, it reminded them not to enter their wallet backup on a website or form.
Mixed Feedback From the Crypto Community
Other users who apparently accessed the same fake website got spooked upon learning about David’s case. Most of them admitted that they weren’t experienced users and were only led to the site by Google’s sponsored link.
Trezor assured them that clicking the URL alone does nothing. It explained that their crypto assets are safe as long as they didn’t enter their wallet backup into the browser.
On the other hand, some critics argued that Trezor should purchase a dot-com domain to eliminate a common mistake that new users usually encounter.
