Trezor User Reports Total Loss Following Google Phishing Ad

The phishing page mimicked the hardware-wallet provider's interface, tricking the user into inputting the 12-to-24-word recovery phrase that grants full access to his assets. Once entered, the attacker restored the wallet on a different device and drained the funds. David shared the wallet address linked to the scam with on-chain investigators ZachXBT and CertiK, asserting the operation had siphoned millions from other victims, though these figures remain unverified.

Trezor issued a public warning shortly after the incident, confirming a rise in sophisticated phishing sites appearing in sponsored search slots. The company reiterated that legitimate wallet providers never request recovery phrases on a website. Experts note that attackers frequently exploit Google’s advertising ecosystem and reputable cloud hosting services to bypass security filters and gain user trust. With blockchain transactions typically irreversible, victims have limited legal recourse, leaving those affected with few options to recover stolen capital.