Worked example · 2025-20

Trezor-impersonating physical-mail seed-phrase phishing campaign — 2025–2026

Loss

Per-victim loss, not a single-incident total. A phishing campaign distributed physical letters — printed on Trezor-branded letterhead with the Trezor logo and product imagery — to cryptocurrency users whose physical addresses were possibly obtained from past customer data breaches (the source only suggests this; how the addresses were obtained is unclear). The letters carried a QR code leading to a fake Trezor setup page and set a deadline of 15 February 2026 to "complete the authentication verification setup"; the page is described as a seed-phrase-harvesting clone. The campaign represents the physical-mail subclass of T11.007.003: the attacker leverages a legitimate hardware-wallet vendor's brand trust plus offline personalisation data to produce apparent legitimacy.

OAK Techniques observed

OAK-T11.007.003 (Brand-Trust Active Phishing — Seed Phrase Exfiltration) — canonical physical-mail sub-pattern anchor. The device is genuine; the communication channel is counterfeit.

Attribution

unattributed — no public attribution.

Key teaching point

The Trezor-impersonating physical-mail campaign demonstrates that T11.007.003 operates across all communication channels — not just email and in-app prompts. A physical letter on vendor-branded letterhead, delivered to the victim's physical address, exploits a deeper layer of trust than a phishing email: the attacker has the victim's physical address (possibly from a prior data breach; unconfirmed), and a printed letter carries an implicit authenticity signal that email does not. The hardware-wallet vendor's invariant holds regardless of channel: no legitimate vendor will ever ask for your seed phrase via any channel — email, mail, phone, app, or support.

Corrected 2026-10-11

Trezor letters are dated February 2026 (15 Feb 2026 deadline) and used a QR code, not a typed domain; the 2025 letters were Ledger-branded; the trezor.io-verify.dev domain, "beginning in 2025" and the Trezor-advisory claims were removed, and the data-breach address source is stated as unconfirmed.