Last Tuesday, a reader forwarded us an email they’d received. The subject line read: “Action Required: Unusual Sign-In Detected on Your Trezor Account.”
The email had Trezor’s logo. It had a professional layout. It had a green “Verify Your Identity” button. It even had a footer with a physical address and an unsubscribe link.
It was completely fake. And if they had clicked that button, they would have been walked through a process that ended with them typing their 24-word seed phrase into a website controlled by the attacker. Every satoshi — gone in seconds.
This is how Bitcoin phishing works. And it is getting terrifyingly good.
Step 1: The Hook
Every phishing attack begins with a trigger — something that creates urgency, fear, or curiosity. The attacker needs you to act before you think. The most common hooks targeting Bitcoin holders are:
- “Unusual activity detected” — Your account, wallet, or device has been compromised. Act now.
- “Firmware update required” — Your hardware wallet has a critical vulnerability. Update immediately.
- “Verify your identity” — New KYC requirements mean you need to re-confirm your details or lose access.
- “You’ve received Bitcoin” — Someone sent you 0.5 BTC. Click to claim it.
- “Support ticket update” — Follows up on a support request you never made, creating confusion that lowers your guard.
Notice the pattern: every hook is designed to make you feel like not clicking is the dangerous choice. That inversion is the entire trick.
Step 2: The Lure
Once you click, you land on a website that looks indistinguishable from the real thing. Modern phishing sites are not the sloppy fakes of a decade ago. They are pixel-perfect clones, often built by scraping the real site’s HTML and CSS directly.
Here is what makes them hard to spot:
- The domain is close. Instead of
trezor.io, you might seetrezor-verify.io,trezor.security-check.com, ortrezcr.io(substituting a similar-looking character). - The SSL certificate is valid. The padlock icon means the connection is encrypted — it does not mean the site is legitimate. Anyone can get an SSL certificate in minutes.
- The design is perfect. Logos, fonts, colours, layout — all identical to the real site. Many phishing kits are automated tools that clone sites in seconds.
Step 3: The Trap
This is where the damage happens. The fake site asks you to “verify” or “recover” your wallet. The process feels familiar because it mimics real wallet setup flows. But at some point, it asks for the one thing no legitimate service will ever request:
Your seed phrase.
The moment you type those 12 or 24 words into a website, a form, an email, a chat window, a “support agent,” or anything connected to the internet, your Bitcoin is gone. The attacker’s script sweeps the wallet — often within seconds, often using automated bots that monitor for newly compromised seeds around the clock.
There is no undo. There is no customer support to call. There is no insurance claim. The transaction is final.
What a Real Phishing Email Looks Like
Here’s a reconstructed example based on real campaigns we’ve tracked. Study it carefully:
Our security team has identified a critical firmware vulnerability (CVE-2026-1847) affecting your device model. Funds stored on unpatched devices may be at risk.
To protect your assets, please complete the verification process within 48 hours:
1. Visit our secure recovery portal: https://trezor-security.com/verify
2. Enter your recovery seed to confirm device ownership
3. A patched firmware will be pushed to your device automatically
Failure to complete this process may result in permanent loss of access to your funds.
— Trezor Security Team
The Five Rules That Make You Immune
Phishing attacks are sophisticated, but defending against them is not. These five rules, followed consistently, make you effectively immune:
- Your seed phrase is never entered anywhere digital. Not a website. Not an app. Not a chat. Not an email. Not a “recovery tool.” It exists on paper or metal, offline, forever. The only time you type it is during wallet recovery on a hardware device — and even then, you type it into the device itself, never a computer.
- Bookmark official sites and use only those bookmarks. Never click links in emails, texts, or social media posts to access your wallet provider, exchange, or node dashboard. Type the URL manually or use a bookmark you created yourself.
- Hardware wallet firmware updates come from the manufacturer’s official app only. Trezor updates come through Trezor Suite. Ledger updates come through Ledger Live. Coldcard updates are verified with PGP signatures. If an email tells you to update firmware through a website, it is a scam. No exceptions.
- No legitimate company will ever email you asking for your seed phrase, private key, or wallet password. Ever. This is absolute. If you receive such a request from any source, it is an attack. Delete it.
- When in doubt, do nothing. Close the email. Close the tab. Wait 24 hours. Real security issues don’t expire in 48 hours. Real companies don’t threaten you with fund loss if you don’t click a link immediately. Urgency is the attacker’s weapon. Patience is yours.
Next issue: Seed Phrase Storage: What the Experts Actually Do — metal plates vs. paper, fire and flood resistance, geographic distribution, and the mistakes that cost people everything. Plus a look at how multi-signature setups let you split your security across multiple locations so no single point of failure can compromise your funds.
Missed Issue #1? Why Your Exchange Account Is Not a Wallet →