Google Sponsors Fake Trezor Phishing, Users Lose All Savings
When users search for Trezor wallet, Google’s top sponsored results lead to a phishing website.
The site is hosted on Google Sites at sites.google.com/view/start-trezor-suite, disguising as the official interface to lure users into entering their recovery phrases.
Victims claim to have lost all their savings, with the related harvesting address bc1qrz33mr7tx8wrpcs2pxrvv83hqwpm907s9shkz4 receiving about 24 bitcoins in total.
Trezor responded that they have upgraded internally and reported the page, emphasizing that users should never enter wallet backups on any website.
This type of Google-sponsored phishing ads continues to exist, with DefiLlama noting that the platform has not effectively addressed the issue and recommends manually curated search tools.
In market mechanisms, attackers gain traffic through paid rankings, quickly transferring funds to harvesting addresses, putting hardware wallet users at risk due to their search habits, while the platform benefits from advertising revenue without bearing security responsibility.
On-chain data shows that after about 80 transactions, most of the funds from this address have been transferred out.
Source: Public Information
ABAB AI Insight
Trezor, as one of the earliest hardware wallet manufacturers, has long faced brand impersonation and phishing attacks, previously warning about the risks of sponsored search results and continuously urging users to verify devices only through official channels.
Attackers exploit Google Ads for paid placements and the trust in Google Sites domains to create highly realistic pages at low cost, motivated by capturing high-value recovery phrases and instantly transferring assets.
Similar phishing cases involving Google ads have repeatedly affected Ledger and several other hardware wallets, currently in a phase where search engine advertising systems are being systematically exploited.
This fundamentally represents a failure of trust mechanisms, where advertising platforms prioritize traffic monetization over brand authenticity verification, making centralized search entry points the biggest single point of risk for decentralized assets.
ABAB News · Law of Cognition
Sponsored results take precedence over real results
Domain trust can be purchased at low cost
Recovery phrases are permanently out of control once offline