šØ Hardware wallet users receive physical phishing letters impersonating Trezor and Ledger as attackers exploit past breaches to steal recovery phrases via snail mail šØ
Threat actors are sending physical letters pretending to be from Trezor and Ledger to trick users into submitting recovery phrases, representing an evolution from digital to postal phishing. The letters claim mandatory "Authentication Check" or "Transaction Check" deadlines (February 15, 2026 for Trezor) and include QR codes leading to phishing sites that request 24-word recovery phrases. Both companies have suffered data breaches exposing customer contact information, enabling targeted physical mail that bypasses digital security awareness.
š Key points
š¹ Physical mail campaign: Letters printed on official-looking letterhead impersonate Trezor and Ledger security teams, warning recipients to complete authentication checks or face disrupted wallet functionality; QR codes direct victims to fake setup pages requesting recovery phrases under the pretense of device verification.
š¹ Recovery phrase = complete control: Hardware wallet recovery phrases are representations of private keys that control access to crypto wallets, meaning anyone with the phrases gains full control over the wallet and its funds; legitimate manufacturers never request these credentials through any channel.
š¹ Breach-enabled targeting: Both Trezor and Ledger have suffered data breaches in the past couple of years that exposed customer contact information, providing attackers with names and addresses to craft convincing impersonation letters years after the original incidents.
š¹ Physical mail advantage: Users of hardware wallets are often less suspicious of physical mail compared to emails or social media messages, making the attack more effective; branded letterhead and postal delivery create legitimacy that digital phishing lacks.
š Why it matters
š¹ Hybrid attack surface: Attackers are pivoting from digital to physical channels as users develop email phishing skepticism, demonstrating that hardware wallet security requires vigilance across all communication mediumsānot just online defense.
š¹ Breach consequences persist: Data leaks continue generating attack opportunities years later as stolen customer databases enable increasingly sophisticated campaigns; a single compromise creates persistent targeting vectors that evolve with attacker tactics.
š¹ Security theater vulnerability: Hardware wallets provide strong cryptographic protection, but social engineering that extracts recovery phrases renders device security meaninglessāthe weakest link remains human trust rather than technical architecture.
šÆ Bottom line: Attackers are mailing fraudulent letters to Trezor and Ledger users claiming mandatory authentication deadlines and directing victims to phishing sites that steal recovery phrases granting complete wallet control. The campaign exploits customer data from previous breaches and bypasses digital security awareness through postal delivery's perceived legitimacy. Hardware wallet security depends on protecting recovery phrases from social engineering across all channelsāmanufacturers emphasize they will never request these credentials, yet physical mail's unfamiliar threat vector makes users vulnerable where email phishing might fail.
https://www.cryptopolitan.com/ledger-trezor-wallet-users-crypto-theft/