Phishing site impersonates Trezor in top Google search result, draining user funds

A phishing site masquerading as Trezor climbed to the top of Google’s sponsored search results on August 7, 2026, siphoning funds from users who were tricked into entering their wallet recovery phrases. The fake page, hosted on Google’s own Sites platform, mimicked Trezor’s legitimate interface closely enough that at least one victim reportedly lost their entire life savings. How the scam worked The phishing page was hosted at a URL beginning with sites.google.com/view/start-trezor-suite, which lent it an air of legitimacy that a random domain wouldn’t have carried. Google Sites is a free website builder anyone can use, and hosting a scam there meant the URL at least started with a domain most people instinctively trust. Once on the page, users were prompted to enter their 12- or 24-word recovery phrases, the master keys to their crypto wallets. Hardware wallets like Trezor generate these seed phrases during initial setup, and anyone who possesses them can reconstruct and drain the wallet from any device, anywhere in the world. Trezor confirmed it is aware of the incident and is working internally to escalate the matter. The company said it is collaborating with Google to get the f...