A cryptocurrency holder lost $282 million in a single theft this January after handing over their 12-word recovery phrase to someone impersonating Trezor support. The attack, which took place on January 10, 2026, is one of the largest social-engineering heists in crypto history. The scammer didn't hack any code — they just asked for the keys.
How the scam played out
The victim received a message from an individual claiming to be a Trezor support agent. The impersonator convinced the holder that sharing the 12-word seed phrase was necessary for a security check or wallet recovery. Once the phrase was provided, the attacker had full access. The $282 million was moved out within hours.
Why seed phrases are the ultimate target
A 12-word seed phrase is the complete key to a cryptocurrency wallet. Unlike a password, it can't be reset. There's no backup email, no two-factor recovery. Whoever holds the phrase controls the funds. That makes seed phrase phishing one of the most dangerous attack vectors in crypto — and one of the hardest to defend against if a user falls for it.
The scale of the loss
$282 million is a staggering amount for a single wallet. It suggests the victim was either a high-net-worth individual or an entity managing a large pool of assets. The source of the funds hasn't been disclosed, and the stolen crypto has not been recovered as of August 2026 — seven months after the theft.
What Trezor has always said
Trezor has repeatedly warned users that its support team will never ask for a seed phrase. The company's official guidance is clear: never share your recovery phrase with anyone, under any circumstances. Not with support, not with a friend, not with a website. The only safe place for a seed phrase is offline, written on paper, and stored securely.
This incident is a brutal reminder that the most sophisticated hardware wallet is only as secure as the person using it. One moment of misplaced trust can cost millions.
