Snail Mail Phishing Targets Trezor and Ledger Wallet Users for Crypto Theft
2 min. read 
Published on
Crooks send fake letters posing as Trezor and Ledger support to steal crypto wallet recovery phrases. Victims scan QR codes under urgency for “mandatory checks.” Sites then grab 12-24 word seeds to drain funds.
Letters use fake letterhead from security teams. Trezor version warns of “Authentication Check” deadline February 15, 2026. Ledger pushes “Transaction Check” by October 2025. QR leads to trezor.authentication-check[.]io or ledger.setuptransactioncheck[.]com.
Access content across the globe at the highest speed rate.
70% of our readers choose Private Internet Access
70% of our readers choose ExpressVPN
Browse the web from multiple devices with industry-standard security protocols.
Faster dedicated servers for specific actions (currently at summer discounts)
Sites mimic official setup. They claim new devices skip steps. “Get Started” leads to seed entry pages. Phrases POST to /black/api/send.php backend. Trezor site lives (Cloudflare blocked); Ledger offline.
The Trezor phishing page displays a warning that users must complete an authentication check by February 15, 2026, stating:
“Complete Authentication Check setup by February 15, 2026 unless you purchased a Trezor Safe 7, Trezor Safe 5, Trezor Safe 3, or Trezor Safe 1 after November 30, 2025. In that case, it is already pre-configured, and no action is needed,” reads the phishing site.
Past breaches leaked Trezor (66,000 users) and Ledger (270,000 addresses) data. Physical scams rare but effective, beating email filters.
Trezor warns: “Trezor will never ask you to enter, scan, upload, or share your recovery phrase.”
Ledger states: “Ledger will never ask for your 24-word recovery phrase. Never enter it on a website.”
Phishing Sites Table
| Target | Domain | Status | Payload |
|---|---|---|---|
| Trezor | trezor.authentication-check[.]io | Live, blocked | Seed grab API |
| Ledger | ledger.setuptransactioncheck[.]com | Offline | Fake check page |
Scam Tactics
- Urgency deadlines create panic.
- Fake models like Trezor Safe 7/5/3/1.
- Supports 12/20/24-word seeds.
- Mimics real features like passphrases.
Never share seeds. Enter only on hardware during restore. Report to firms.
Protection List
- Ignore unsolicited mail from wallet makers.
- Verify via official apps/sites only.
- Move funds if seed exposed.
- Use passphrases for extra security.
FAQ
Bypasses email filters; data from past breaches targets users.
Attacker imports wallet, steals all funds instantly.
No, never via mail, email, or sites.
Trezor yes (blocked); Ledger no.
Fake Ledger devices mailed in 2021.
Read our disclosure page to find out how can you help VPNCentral sustain the editorial team Read more
Improve this guide
User forum
0 messages