A bitcoin and litecoin holder lost $282 million on January 10, 2026, after sharing a 12-word recovery phrase with an individual impersonating Trezor customer support. The funds were drained within minutes. The incident did not involve a break of cryptography; the loss occurred because control of the recovery phrase confers full control of the wallet.
Incident Overview
According to details shared after the event, the victim disclosed a 12-word recovery phrase—commonly used by self-custody wallets—to someone claiming to be support staff for Trezor, a prominent hardware wallet brand. Once the phrase was provided, the attacker imported the wallet and transferred the assets. In such cases, blockchain transactions are irreversible, and possession of the recovery phrase is equivalent to possession of the funds.
The 12 Words Are Not a Password
Recovery phrases (often 12 or 24 words) are derived from the BIP39 standard and generate the wallet’s master private keys. They are not passwords and cannot be reset or changed after exposure. Anyone who knows the phrase can recreate the wallet, view balances, and move assets without additional authorization. This design enables self-custody and portability but also concentrates risk: a single point of compromise can result in total loss.
Support Impersonation Scams
Impersonation of crypto wallet support teams has become a recurring social engineering tactic. Scammers may use lookalike profiles, fake help-desk forms, or convincing prompts urging users to “verify” or “recover” their wallets. Legitimate wallet providers consistently warn that they will never ask users for their recovery phrases or private keys through support channels, email, or chat.
Security Practices to Reduce Risk
- Never share your recovery phrase or private keys with anyone, including purported support staff.
- Verify official support channels and URLs; avoid links from unsolicited messages or search ads.
- Store recovery phrases offline in secure locations; consider durable backups (e.g., metal) against fire or water damage.
- Use a wallet passphrase (if supported) to add an additional layer of protection, and understand how to back it up safely.
- Keep device firmware and wallet software up to date using official sources only.
- Consider multisignature or hardware-based setups that reduce single points of failure.
- Perform small test transactions when interacting with new addresses or recovery procedures.
The case underscores the core principle of self-custody: the recovery phrase represents the wallet itself. Maintaining strict control over those words is essential to safeguarding digital assets.