Fake Trezor Rep Steals $282 Million in a Phone Call

What Happened

On January 10, 2026, at approximately 11:00 PM UTC, a crypto investor lost 1,459 Bitcoin and 2.05 million Litecoin through a hardware wallet social engineering attack. Total value at time of theft: over $282 million, making it the largest individual crypto theft of 2026 and one of the largest social engineering heists on record.

Blockchain investigator ZachXBT disclosed the incident on January 16 via his Telegram channel and social media, reconstructing the laundering flow from on-chain data. Security firm ZeroShadow confirmed the attack vector: the victim had been contacted by someone impersonating Trezor 'Value Wallet' customer support.

The attacker convinced the victim to reveal their 24-word seed phrase. Once that phrase was in the attacker's hands, the hardware wallet's cryptographic protections were irrelevant. ZeroShadow flagged the compromised address and froze approximately $700,000 before conversion. The rest moved too fast.

ZeroShadow managed to identify the compromised address and flag portions of the stolen funds in real time, successfully freezing approximately $700,000 before conversion. The rest moved too fast.

The hardware wallet was fine. The human was the vulnerability.

The Laundering Operation

ZachXBT's reconstruction shows a coordinated, pre-planned operation with clear knowledge of blockchain forensics. Rather than moving funds in large blocks, the attacker split the stolen BTC and LTC into many smaller swaps, specifically to increase entropy and complicate clustering.

Those fragments were routed through multiple instant exchange services and converted into Monero. XMR was chosen deliberately: its stealth addresses, ring signatures, and confidential transaction amounts make sender, receiver, and value effectively untraceable once inside the network.

The volume of XMR buying caused Monero's price to spike roughly 90%, from approximately $420 to nearly $800, within hours. That anomaly was visible enough that it became one of ZachXBT's tracking signals.

In parallel, portions of the stolen Bitcoin were bridged via THORChain, a decentralized cross-chain protocol enabling native asset swaps without centralized custody. The attacker routed funds into Ethereum, Ripple, and Litecoin, spreading the trail across multiple chains and liquidity pools.

THORChain avoids the KYC choke points of major exchanges, which is why it appears repeatedly in high-value laundering cases. ZachXBT was able to follow the macro flows, but once funds entered Monero fully, the on-chain trail stopped. Recovery prospects at that point are effectively zero.

Red Team: How the Attack Was Structured

Breaking the attack into steps makes the playbook clear. Step one: establish credibility. The attacker made contact impersonating Trezor support using a spoofed number, convincing website, or professional-sounding script. Step two: create a threat. The victim was told their wallet was at risk, their device had been flagged, or their funds needed to be migrated.

The framing varies, but urgency is always present. Step three: direct to action. The victim was led through a process that required entering, reading aloud, or confirming their 24-word seed phrase to 're-verify' or 'unlock' the wallet. Step four: sweep and launder. Immediately upon obtaining the seed, the attacker imported it and began moving funds.

The entire operation completed within hours.

What the attacker needed the victim to do at each step: answer the contact, accept the authority framing, stay engaged under time pressure, and provide the seed phrase. Everything after that required no further victim involvement. This structure is replicable at scale. Crime-as-a-service kits for hardware wallet impersonation are documented in industry threat reports.

The $330 million theft from an elderly American in April 2025, where an attacker obtained 3,520 BTC via a similar manipulation campaign, followed the same sequence. ZachXBT confirmed neither incident was North Korean in origin.

Blue Team: Controls That Break the Chain

The attack has four steps. Any one of them, stopped, prevents the loss. Step one breaks on a single rule: do not engage with unsolicited contact about your wallet. Trezor, Ledger, and every legitimate hardware wallet manufacturer will not contact you proactively. If something appears to come from them, it is a scam.

The correct response to any inbound support contact regarding your wallet is to end it and reach out to the manufacturer directly through their official website. For Trezor, that is trezor.io — no other domain is legitimate.

Step two breaks on another absolute rule: no legitimate process will ever ask for your seed phrase. Not to verify your wallet. Not to migrate your funds. Not to unlock a freeze. Not to restore access. The seed phrase lives offline on paper or metal, seen by no one. Any interaction that requires you to enter, photograph, read aloud, or confirm it anywhere is an attack.

This is not a nuanced judgment call. It is a hard line.

Step three breaks with a BIP-39 passphrase. If you add a passphrase to your wallet, the seed phrase alone cannot access your real funds. An attacker who obtains the seed finds only a decoy balance at the base derivation path. This is a genuine second factor: it is never stored on the device, never transmitted, and unknown to any attacker who only has the seed.

For holdings at this scale, a passphrase is not optional.

Step four, the sweep, is where ZeroShadow intervened and recovered $700,000. Real-time monitoring of high-value wallet addresses for unexpected outflows provides a narrow window to flag and freeze funds at exchanges before Monero conversion. For holdings in this range, address monitoring services are worth understanding and using.

What to Watch

No U.S. law enforcement agency has publicly acknowledged an investigation into the January theft as of this writing. The scale and the use of instant exchanges in the laundering chain make federal attention likely. Watch ZachXBT's public channels for further attribution. He identified the perpetrators in the August 2024 $243 million case and arrests followed in Miami, Los Angeles, and Dubai.

He has indicated ongoing monitoring of the January 2026 flows.

Tracked entities this report names, with total coverage across the archive. Follow one into the Actor Network to see every report it appears in.

Other reports that name the same tracked actors — a different thread than “related,” which follows wording. These are linked by who appears in them.