Hackers impersonate Trezor employees to commit social engineering scams, stealing $282 million worth of BTC and LTC

Source: Criptonoticias Original Title: Hackers Pose as Trezor Employees and Steal $290 Million Original Link: https://www.criptonoticias.com/sucesos/hackers-trezor-bitcoin-litecoin/ In the fast-paced world of cryptocurrencies, risks not only stem from market volatility but also from sophisticated digital scams.

On January 10, 2026, around 11:00 pm UTC, an anonymous user experienced one of the largest thefts in recent history: the loss of over $282 million in Bitcoin (BTC) and Litecoin (LTC).

According to on-chain investigator ZachXBT, the incident involved 1,459 BTC (valued at approximately $139 millions) and 2.05 million LTC (equivalent to $153 millions).

On January 10, 2026, around 11 pm UTC, a victim lost $282M+ in LTC and BTC due to a social engineering attack on a hardware wallet.

The attacker began converting the stolen LTC and BTC to Monero through multiple instant exchanges, causing the XMR price to rise significantly.

The method employed by the hackers was a social engineering attack. The scammers impersonated Trezor employees, the popular hardware wallet manufacturer with over 2 million users. The involved parties tricked the victim into revealing their seed phrase, granting them full access to the funds.

Once in control, the hackers acted quickly to obfuscate the trail. They converted much of the stolen assets into Monero (XMR), through instant exchanges.

This massive conversion triggered a rally in the XMR price, which rose over 36% in seven days, reaching peaks near $800 before correcting to around $621.

Additionally, they used Thorchain, a decentralized cross-chain bridging protocol, to transfer BTC to networks like Ethereum, Ripple, and Litecoin.

Cybersecurity firm ZeroShadow intervened by tracking and freezing over $700,000 in funds before they completed the conversion to Monero.

This case is not isolated; it highlights a trend where technical attacks give way to psychological manipulations. ZachXBT clarified that it is not a state-sponsored group but probably independent cybercriminals.

The identified theft addresses include bc1qluxw46r55wf3dnk9c652vrt4duadm3hpuktf86 for BTC and ltc1qly43c2prj4c2e85dcspzpjd36jnapnenldnr70 for LTC.

The implications are profound for the community. It is always important to remember that multiple layers of security such as two-factor authentication, multi-signature wallets, and knowing that a company like Trezor, or another reputable manufacturer, will not ask for seed words from any of its users.