Overview
- A paid Google search ad directed users to a Google Sites page that impersonated Trezor and asked for 12‑ or 24‑word recovery seed phrases, which grant attackers full control of wallets.
- A crypto user who posts as David (@ReallyBadDay99) said he lost his life savings and shared a suspected harvesting address, but independent verification of his loss and the campaign's total theft is not available.
- Trezor confirmed it is aware of the fraudulent page, urged users never to share seed phrases with any website, and said it is working with Google to remove the sponsored ad.
- Security researchers say the episode follows repeated 2025–2026 campaigns that used sponsored search ads and trusted hosting to push phishing pages, with prior reports linking similar schemes to roughly $1.27 million and a separate Uniswap‑related theft of about $400,000.
- Because blockchain transfers cannot be reversed, victims have limited options after funds move and users should bookmark official wallet sites, avoid entering seed phrases online, and treat any exposed seed as compromised.