• Crypto hackers target Trezor and Ledger users through mailed phishing letters.
• Fake authentication checks request wallet recovery phrases via QR codes.
• Entering seed phrases gives attackers full control over funds.
Crypto hackers target Trezor and Ledger users in a coordinated phishing campaign that now extends beyond email into physical mail.
Attackers are sending printed letters that impersonate the hardware wallet makers. The letters urge recipients to complete urgent “authentication” or “transaction” checks.
Security experts warn that the scheme aims to steal wallet recovery phrases and drain funds.
Hackers Impersonate Hardware Wallet Firms Through Mailed QR Codes
According to reports shared by cybersecurity researcher Dmitry Smilyanets on X, recipients received official-looking letters branded as Trezor.
The documents claim users must complete a mandatory “Authentication Check.” The letters set a deadline of February 15, 2026.
Meanwhile, similar letters impersonating Ledger reference a required “Transaction Check.”
Both versions instruct users to scan a QR code. The code directs them to phishing websites designed to mimic official wallet portals.
The fake pages request 24-, 20-, or 12-word recovery phrases. They claim the words verify device ownership and restore full functionality.
However, hardware wallet providers never ask users to share seed phrases.
Once victims submit the recovery words, the data transmits through backend API endpoints controlled by attackers. Criminals then import the wallet onto their own device and move the funds.
Urgency Tactics Exploit Fear of Device Lockouts
The letters create artificial pressure.
In one Trezor-branded message reviewed by Smilyanets, the sender warned that failure to comply could disrupt access to Trezor Suite.
“To avoid any disruption to your Trezor Suite access, please scan the QR code with your mobile device and follow the instructions on our website,” the letter stated.
Similarly, the phishing sites display warnings about limited access, transaction signing errors, and future update disruptions.
The messages also claim devices purchased after November 30, 2025 come pre-configured. As a result, earlier buyers feel compelled to act.
Security analysts note that urgency remains a core phishing tactic. By imposing deadlines and suggesting technical failure, attackers reduce the chance victims will verify the request.
Context: Prior Data Breaches Raised Exposure Risks
Both Trezor and Ledger suffered data breaches in recent years that exposed customer contact information.
Those incidents included names, emails, and in some cases physical addresses. Although the companies stated that private keys and recovery phrases were not compromised, leaked contact data created new risks.
Traders remember previous waves of phishing emails and SMS attacks that followed those breaches. The shift to physical letters marks an escalation.
Because hardware wallets store private keys offline, attackers must rely on social engineering. Therefore, seed phrase theft remains the primary method to bypass device security.
Market Impact: Security Risks Resurface for Hardware Wallet Sector
The campaign has not yet triggered measurable token price volatility tied directly to Trezor or Ledger-related products.
However, security incidents often influence sentiment around self-custody tools.
In past breach-related events, online discussion spikes coincided with short-term trust concerns among retail users. Still, no evidence currently suggests a systemic compromise of wallet infrastructure.
Industry observers say the threat highlights ongoing operational risks in crypto custody, particularly as adoption expands globally.
Industry View: Experts Reiterate Core Security Rule
Security professionals emphasize a single rule: never share a recovery phrase.
Hardware wallet firms consistently state that no employee, update process, or verification step requires seed words.
According to standard wallet design principles, possession of the recovery phrase equals full control of the assets.
Consequently, entering the phrase into any website effectively transfers ownership.
The campaign underscores how phishing tactics in crypto continue to evolve beyond email and text messages into physical mail. While hardware wallets remain secure by design, social engineering remains the weakest link in self-custody. By exploiting leaked contact data and creating artificial urgency, attackers are targeting user behavior rather than device vulnerabilities. As adoption expands, security awareness may prove as important as technical safeguards. Users should treat unsolicited communications with caution and verify any claims directly through official channels before taking action.
