A phishing page hosted on Google Sites appeared as a sponsored result above the real Trezor website. It asked users for their seed phrase, immediately draining their wallets. ~80 transactions, 24 BTC stolen. At least one victim lost their entire life savings.
Trezor flagged this in March and again this week. Google still ran the ad.
EXPLANATION (optional, only if really interested):
The fake site looked identical to trezor.io but was hosted on sites.google.com, making it appear legitimate. When users entered their 12 or 24-word seed phrase thinking they were "recovering" their wallet, the phrase was sent directly to the attackers who instantly swept every wallet generated from it. The attack worked because Google's ad system allowed anyone to buy a sponsored placement above the real Trezor site, and the Google Sites domain gave it a false sense of legitimacy. Never enter your seed phrase on any website, ever.
Never type your seed phrase anywhere except your physical Trezor device. 👇
🤖 Sponsored by aluy.net, the #1 VPS & RDP provider!
🔔 @Observer • 💬 Join community • 🎁 Weekly Giveaway