Hackers impersonate Trezor employees to carry out social engineering attacks, stealing $282 million worth of BTC and LTC

Source: Criptonoticias Original Title: Hackers impersonate Trezor employees and steal $290 million Original Link:

A Precise Social Engineering Attack Case

In the rapidly changing world of cryptocurrency, risks come not only from market volatility but also from carefully planned digital fraud.

On January 10, 2026, around 11:00 PM (UTC), an anonymous user experienced one of the largest robberies in recent history: losses exceeding $282 million in Bitcoin(BTC) and Litecoin(LTC).

According to on-chain investigator ZachXBT, this incident involved 1,459 BTC (approximately $139 million) and 2.05 million LTC (approximately $153 million).

Attack Method: Carefully Designed Identity Impersonation

The hackers employed social engineering attacks. The fraudsters impersonated Trezor (a well-known hardware wallet manufacturer with over 2 million users) employees, deceiving victims into revealing their recovery seed phrases, thereby gaining full control over the funds.

Once in control, the hackers acted quickly to cover their tracks. They converted most of the stolen assets into Monero (XMR) through instant exchanges.

This large-scale conversion caused the price of XMR to rise, increasing over 36% in seven days, reaching a high near $800, then retracing to about $621.

Additionally, they used Thorchain, a decentralized cross-chain bridging protocol, to transfer BTC to networks like Ethereum, Ripple, and Litecoin.

Tracking and Freezing

Cybersecurity firm ZeroShadow intervened to track and freeze over $700,000 of funds, preventing them from completing the conversion to Monero.

Broader Security Lessons

This case is not isolated; it reflects a trend: technical attacks are giving way to psychological manipulation. ZachXBT clarified that this is not a state-sponsored organization but very likely independent cybercriminals.

The identified theft addresses include: BTC address bc1qluxw46r55wf3dnk9c652vrt4duadm3hpuktf86 and LTC address ltc1qly43c2prj4c2e85dcspzpjd36jnapnenldnr70.

The impact on the community is profound. It is essential to always remember to adopt multi-layer security measures, such as two-factor authentication and multi-signature, and to keep in mind that Trezor or other reputable manufacturers will never ask users for seed phrases. This is a fundamental principle for protecting crypto assets.