Phishing site impersonates Trezor in top Google search result, draining user funds

A phishing site masquerading as Trezor climbed to the top of Google’s sponsored search results on August 7, 2026, siphoning funds from users who were tricked into entering their wallet recovery phrases. The fake page, hosted on Google’s own Sites platform, mimicked Trezor’s legitimate interface closely enough that at least one victim reportedly lost their entire life savings.

How the scam worked

The phishing page was hosted at a URL beginning with sites.google.com/view/start-trezor-suite, which lent it an air of legitimacy that a random domain wouldn’t have carried. Google Sites is a free website builder anyone can use, and hosting a scam there meant the URL at least started with a domain most people instinctively trust.

Once on the page, users were prompted to enter their 12- or 24-word recovery phrases, the master keys to their crypto wallets. Hardware wallets like Trezor generate these seed phrases during initial setup, and anyone who possesses them can reconstruct and drain the wallet from any device, anywhere in the world.

Trezor confirmed it is aware of the incident and is working internally to escalate the matter. The company said it is collaborating with Google to get the fraudulent ad removed and has reminded users of a cardinal rule in crypto security: never share your seed phrase with anyone or any website, ever.

A pattern, not an anomaly

This attack didn’t emerge from a vacuum. Paid search ad fraud targeting crypto users has become a recurring problem throughout 2025 and 2026. In May 2026, a similar scheme involving fake Uniswap sites reportedly cost users more than $400,000.

Trezor and its community have long flagged the risk of misleading ads that frequently overshadow legitimate search results. Sponsored results appear above organic ones, meaning a well-funded attacker can literally outrank the legitimate company in search results.

Why Google ads remain a weak link

The uncomfortable question this incident raises is about Google’s ad screening process. A phishing page impersonating a well-known financial product made it through whatever review mechanisms exist and landed in the single most visible position on the results page.

For crypto users, the defensive playbook remains the same as it has been for years. Bookmark official sites rather than searching for them. Never enter a recovery phrase into any website. Treat sponsored search results with deep skepticism, especially for anything involving financial products. And remember that a legitimate wallet provider will never, under any circumstances, ask for your seed phrase through a web form.

Disclosure: This article was edited by Editorial Team. For more information on how we create and review content, see our Editorial Policy.