Key Takeaways
- • A Google-sponsored phishing ad directed Bitcoin users to a counterfeit Trezor wallet page, resulting in the theft of approximately 24.04 BTC ($1.6 million) from at least one victim who entered their recovery seed into the fake site.
- • The attacker's wallet received 24.04 BTC across 80 transactions, with nearly all funds subsequently moved, leaving only 0.04 BTC remaining—demonstrating rapid fund laundering following the exploit.
- • BTCPay Server confirmed a concurrent critical vulnerability actively being exploited in the wild, prompting an emergency patch release (version 2.4.2) to address the security flaw.
- • Neither incident compromised the Bitcoin protocol or hardware wallets themselves; both attacks succeeded through social engineering and user-side operational security failures (seed phrase exposure and unpatched server software).
- • Trezor emphasized that the hardware wallet was never breached and advised users to verify official website URLs and never input recovery seeds into web forms or external websites.
Summary
Two significant security incidents targeting Bitcoin users emerged within a 24-hour window in early August 2026, each presenting distinct but critical risks to cryptocurrency holders despite neither compromising the underlying Bitcoin protocol.
The first incident involved a sophisticated phishing campaign leveraging Google's sponsored ad network. A user identified as David reported on August 6, 2026, that a counterfeit Trezor wallet page, hosted on Google Sites, appeared at the top of sponsored search results for "Trezor wallet," positioning it above the legitimate Trezor website. The phishing page successfully captured at least one user's recovery seed phrase, granting attackers complete control over the wallet. On-chain analysis revealed the attacker's address received 24.04 BTC across 80 transactions—approximately $1.6 million at Bitcoin's then-current price near $65,172. The funds moved rapidly through subsequent transactions, with only 0.04 BTC remaining in the original harvesting wallet, suggesting immediate laundering activity.
The attack methodology mirrors recent precedent. A similar counterfeit Uniswap phishing site drained $400,000 from victims in May 2026, underscoring a pattern of attackers exploiting Google's ad placement system to gain credibility and traffic. Trezor responded by reporting the page for takedown and escalating internally, while emphasizing that hardware wallets themselves were not compromised—the breach required users to voluntarily expose their recovery seeds outside the device.
Concurrently, BTCPay Server announced a critical vulnerability already under active exploitation in the field. The project confirmed the flaw and released an emergency patch (version 2.4.2), urging all users to upgrade immediately. While specific technical details regarding the vulnerability's scope and affected value remain limited in available reporting, security researchers indicated the flaw posed direct risk to user funds.
Trezor's official guidance underscored the operational security principle central to both incidents: users must verify official websites and never input backup seeds or sensitive credentials into external forms or websites. The incidents collectively highlight that while protocol-level security remains robust, end-user behavior and third-party infrastructure represent acute vulnerability vectors in the custody and management of digital assets.
The first incident involved a sophisticated phishing campaign leveraging Google's sponsored ad network. A user identified as David reported on August 6, 2026, that a counterfeit Trezor wallet page, hosted on Google Sites, appeared at the top of sponsored search results for "Trezor wallet," positioning it above the legitimate Trezor website. The phishing page successfully captured at least one user's recovery seed phrase, granting attackers complete control over the wallet. On-chain analysis revealed the attacker's address received 24.04 BTC across 80 transactions—approximately $1.6 million at Bitcoin's then-current price near $65,172. The funds moved rapidly through subsequent transactions, with only 0.04 BTC remaining in the original harvesting wallet, suggesting immediate laundering activity.
The attack methodology mirrors recent precedent. A similar counterfeit Uniswap phishing site drained $400,000 from victims in May 2026, underscoring a pattern of attackers exploiting Google's ad placement system to gain credibility and traffic. Trezor responded by reporting the page for takedown and escalating internally, while emphasizing that hardware wallets themselves were not compromised—the breach required users to voluntarily expose their recovery seeds outside the device.
Concurrently, BTCPay Server announced a critical vulnerability already under active exploitation in the field. The project confirmed the flaw and released an emergency patch (version 2.4.2), urging all users to upgrade immediately. While specific technical details regarding the vulnerability's scope and affected value remain limited in available reporting, security researchers indicated the flaw posed direct risk to user funds.
Trezor's official guidance underscored the operational security principle central to both incidents: users must verify official websites and never input backup seeds or sensitive credentials into external forms or websites. The incidents collectively highlight that while protocol-level security remains robust, end-user behavior and third-party infrastructure represent acute vulnerability vectors in the custody and management of digital assets.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.