Fake Trezor Support Social Engineering — $282M Heist
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·2iwrMP…Fj2MSummary
On January 10, 2026, an unidentified victim lost approximately $282 million in Bitcoin and Litecoin after an attacker impersonating Trezor 'Value Wallet' customer support convinced the victim to disclose their 24-word seed phrase, granting the attacker complete wallet access. This is the largest individual social engineering crypto theft ever recorded, surpassing the previous record of $243 million set in August 2024. Stolen funds were laundered through ThorChain, multiple instant exchanges, and converted predominantly into Monero, causing XMR to surge up to 80% in the days following the incident; no suspect has been publicly identified and full recovery is considered extremely unlikely.
Connected Entities
10 entities · 60 linked investigations- Ethereum→mentioned with→Bitcoin(60%)
- Monero→mentioned with→Bitcoin(60%)
- Monero→mentioned with→ZachXBT(65%)
- Litecoin→mentioned with→Bitcoin(70%)
- ZachXBT→mentioned with→Ethereum(70%)
- Litecoin→mentioned with→Monero(65%)
- ZachXBT→mentioned with→Malone Lam(80%)
- Litecoin→mentioned with→ZachXBT(70%)
- ZachXBT→mentioned with→Bitcoin(65%)
- Gemini Exchange→mentioned with→Bitcoin(80%)
- + 24 more
Timeline(7 events)
19 August 2024
Previous record set: a Genesis creditor loses $243 million in Bitcoin (4,064 BTC) via social engineering, with attackers impersonating Google and Gemini support. This case results in two DOJ indictments in September 2024.
CoinDesk10 January 2026
At approximately 23:00 UTC, an unknown victim loses approximately 1,459 BTC (~$139M) and 2.05 million LTC (~$153M) after disclosing their 24-word seed phrase to an attacker impersonating Trezor 'Value Wallet' customer support. Total loss: ~$282 million.
CoinDesk / ZachXBT / ZeroShadow10 January 2026
Within approximately 20 minutes of the theft, ZeroShadow identifies the attack in real time and freezes approximately $700,000 worth of assets before they can be converted to Monero.
FinanceFeeds / Bitcoinist10 January 2026
The attacker begins laundering stolen BTC through ThorChain, bridging to Ethereum, XRP, and Litecoin, while converting the bulk of stolen funds to Monero (XMR) through multiple instant exchanges.
CoinDesk / FinanceFeeds14 January 2026
Monero (XMR) reaches an all-time high of approximately $797–$800, a surge of approximately 70–80% from pre-theft price levels, as market liquidity absorbs the large-scale conversion of stolen assets.
Bitcoin.com News / Ainvest16 January 2026
CoinDesk and other major outlets publish detailed reporting on the theft, citing ZachXBT's analysis and ZeroShadow's findings. ZachXBT publicly excludes North Korean state-sponsored actors as suspects.
CoinDesk16 February 2026
A separate but related hardware wallet impersonation campaign surfaces: physical letters sent via postal mail to Trezor and Ledger customers, impersonating official company communications and directing recipients to scan QR codes leading to seed-phrase phishing sites.
BleepingComputerDecision Log
- hash: Br6aQYVjxbUCEs3LgeixpwxAaaasMATmXHCdB6KCYtTM
This investigation is cryptographically anchored to the Solana blockchain (1 event). 17 of 18 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 7/1/2026, 11:09:45 PM
last updated: 7/27/2026, 10:56:32 AM
3 viewsavoid.net — verified advice for a post-truth world