TLDR Tech / InfoSec
Snail mail letters target Trezor and Ledger users in crypto-theft attacks
Threat actors are sending physical letters impersonating Trezor and Ledger security teams, urging hardware wallet users to complete fake "Authentication Check" or "Transaction Check" processes by scanning QR codes that lead to phishing sites designed to steal recovery phrases. The campaign likely leverages customer data exposed in prior Trezor and Ledger data breaches, with phishing domains such as trezor.authentication-check[.]io exfiltrating submitted seed phrases via a backend API endpoint. Hardware wallet manufacturers will never request recovery phrases through mail, email, or websites — seed phrases should only ever be entered directly on the hardware device itself.
Read the full story