Hijacked Google Ads, stolen seeds: where the bitcoin of a Trezor phishing wave ended up

Anyone who searched Google for "Trezor Suite" in late October 2026 saw, above the genuine results, an ad leading to a convincing copy of the wallet software. The page, sometimes on its own domain, sometimes as a Google Sites page, asked for the recovery seed, supposedly to restore the wallet. Whoever typed it in watched their balances disappear within minutes. The reporting platform Chainabuse now holds five reports on the campaign from several countries, one of them with a police complaint filed in the Czech Republic according to the reporter. The losses range from bitcoin to ether and stablecoins.

We looked at the bitcoin side of this wave with Coinator. It is compact, well documented and instructive, because it leads in a few steps from the victim to the point where the money leaves the blockchain towards fiat.

Two collector addresses, one of them reported by nobody

Victims do not pay the attacker directly but a collector address that stays fixed for the duration of the campaign. The reported address received 39 payments totalling 3.32 BTC between 27 and 31 October; the largest single report puts one victim's loss at just over 0.2 BTC.

The second collector is more interesting. It appears in no report at all. We only noticed it at the next step, because it was emptied together with the reported address. It had gathered 8.17 BTC in 56 payments, more than twice as much. For the number of victims this means that the five reports show only a small slice. The chain holds about 95 payments into the two collectors.

Stage 2 received considerably more than the two collectors combined. The remainder comes from earlier inflows that we do not follow here; this campaign is evidently not the operator's first.

The sweep and the peel chain

On 31 October at 15:57 UTC the second collector was emptied in a single transaction with 56 inputs, twelve minutes later the first with 33 inputs. Both transactions pay the same address, stage 2. From 17:12 UTC the distribution starts from there, in the pattern we already described for the Binance hack, only on a smaller scale: each transaction peels an amount off to a fresh address and keeps the rest as change, first 2.0 BTC, then 2.86 BTC, then 1.54 BTC.

The three transactions of the peel chain visibly come from a single wallet. They share transaction version, locktime and replaceability flag, use the same address format throughout and pay exactly the same fee of 564 satoshi every time, regardless of the amount. That is the behaviour of a widespread mobile wallet that derives its fee from a fixed rate per byte. Nothing beyond "one wallet, one operator" can be read from this, and we claim nothing beyond it.

The cash-out

Two of the three peeled amounts, 2.0 and 2.86 BTC, sit untouched on their addresses. The third, 1.54 BTC, was passed on the same night in three steps: first 0.01 BTC as a test transfer, then 0.5 BTC, then the remaining 1.03 BTC. All three parts end up, each via one intermediate address, in the same place: the hot wallet of a custodial service.

That service is the real find of this analysis. Its hot wallet has seen around 139,000 transactions and 37,000 BTC of turnover since February 2025, with 162,000 deposit addresses attached, almost every one of them used exactly once. Payouts go out in an unchanging shape to unrelated recipients, among them deposit addresses of large exchanges and of a darknet market. That is the picture of a service that holds customer funds and pays out on request, not of a thief.

And it is the sink not only for this campaign. In the reports of recent months the same hot wallet appears twice more as the endpoint: once in August as the destination of a fake Kraken support scam, once in late October in a carefully documented case from Argentina in which a thief moved the balances of two wallets there in three hops. Three different perpetrators, three different schemes, one cash-out point. Whoever runs this service evidently asks no questions about where the money comes from.

The trap: a deposit address is not the depositor

This is a good place to look at a mistake we nearly made ourselves while retracing the flow, and which the tracer from Argentina did make. Following the attacker's 0.01 BTC test transfer in the graph leads to a deposit address of the service. A few hours later that address is spent, together with eight other deposit addresses and two inputs from the hot wallet itself, and 0.29 BTC flow to a fresh address. It looks as if the attacker had retrieved his money and multiplied it.

He has not. The transaction is a payout by the service to some customer. The service spends deposit addresses and hot wallet together because both belong to it; whose money originally sat on which deposit address no longer matters to it. The 0.29 BTC belong to the recipient of the payout, about whom the chain says nothing. The Argentinian report consequently lists the hot wallet as a "reported address", which is factually wrong: what deserves reporting is the deposit, not the service. In Coinator this rule is hard-wired: the deposit address belongs to the service, the depositor appears only in the transaction with which they deposited. Every trace of stolen funds ends at the hot wallet. What comes after it is customer traffic.

Similarity is not a name

Which service this is, we do not know. The usual attribution sources know the hot wallet only as "high transacting", without a name, and the reporters name none either. What we have instead is a comparison. Coinator keeps profiles of the larger clusters on the blockchain built from measurable properties: how addresses are generated and reused, how deposits and payouts are distributed, which counterparties occur, how fees are set. Placing the profile of this hot wallet next to the named clusters, retail custodial services come closest: wallet apps with their own custody, online casinos, small exchange services. Large exchanges and mixers look different.

That is a conjecture about the kind of service, not evidence of its identity, and we treat it as such. In Coinator the cluster therefore carries no label but a profile noting that the name is open. As soon as it surfaces, in a future report, a court document or the operator's own disclosure, the label will attach to evidence that is already assembled. We consider that separation more important than a quick answer: a similarity tells you where to look. A name is something you have to prove.

Status and outlook

On 3 November, 8.87 BTC from the campaign sit unspent on three addresses, the remainder of stage 2 and the two peeled amounts. We are watching them. As soon as they move, we will add the path here.

For hardware wallet users the lesson is old but evidently still necessary: Trezor Suite is only available from the manufacturer's website, never from an ad, and no legitimate program ever asks for the recovery seed on a website. Anyone already affected should report the case to the police and on Chainabuse. Every additional report makes the collector addresses more visible, and as this case shows, the chain itself is often more complete than the reports.

Update, 4 November 2026

On the evening of 3 November at 19:47 UTC the first of the two untouched amounts moved. From the 2.0 BTC of the first peel, 0.009 BTC were split off; the remaining 1.991 BTC went back to the same address as change. The transaction carries the same signature as the three steps of the peel chain: same version, same locktime, same replaceability flag and once again exactly 564 satoshi in fees. It is the same wallet, and the small amount matches the procedure of 31 October, when the cash-out of the 1.54 BTC branch also started with a test transfer.

The path of the 0.009 BTC is short. They passed through a fresh Taproot address that was spent again within the same block and ended up, apart from a remainder of about 3,700 satoshi, on a deposit address of the custodial service described above. Three blocks later the service swept that deposit address into its hot wallet together with four other addresses of its cluster, among them the hot wallet itself. That is exactly the sweep mechanism from the section on the trap: from here on it is the service's customer traffic, no longer the attacker's money.

So the second branch of the peel chain cashes out through the same point as the first. 8.86 BTC now remain unspent on four outputs: 4.0056 BTC in stage 2, 2.8643 BTC from the second peel and 1.991 BTC left of the first. We keep watching and will add to this section as soon as larger amounts follow.