Trezor Scam: Lost 282 Million in Bitcoin and Litecoin

The cryptocurrency sector has been rocked by one of the largest thefts in its recent history. A single investor fell victim to a sophisticated social engineering attack, losing an estimated fortune of over $282 million between Bitcoin (BTC) and Litecoin (LTC).

The incident, revealed on 16 January by noted on-chain investigator ZachXBT, highlights the growing human vulnerabilities in an increasingly technically armoured ecosystem.

The dynamics of the theft: the fake support Tezor

According to what the cybersecurity firm confirmed ZeroShadow, the attack was not the result of a flaw in the code or a hack directed at the blockchain, but of psychological manipulation. The attackers posed as the customer service department of Trezor, one of the world's leading hardware wallet manufacturers with over 2 million users.

Through brand impersonation tactics, the criminals managed to convince the victim to reveal their 'recovery seed phrase'. Once this universal access key was obtained, the hackers took total control of the wallet, instantly draining 1,459 Bitcoins and as much as 2.05 million Litecoin.

The laundering through thorchain and the role of monero

Simmediately after the heist, the perpetrator started a complex laundering operation to make his tracks disappear. ZachXBT reported that the attacker used several instant exchanges, exploiting Thorchain's decentralised infrastructure in particular. The latter was used to convert the stolen Bitcoins into Ethereum (ETH), Ripple (XRP) and further into Litecoin.

On 10 January 2026, at around 23:00 UTC, a victim lost more than $282 million in LTC and BTC due to a social engineering scam linked to a hardware wallet. The attacker began converting the stolen LTC and BTC into Monero through several instant exchanges, causing their price to rise sharply. According to stated by ZachXBT on X, Bitcoins were also transferred to Ethereum, Ripple and Litecoin via the Thorchain protocol.

The massive use of Thorchain has raised sharp criticism of the platform. This is not the first time that malicious actors have used this protocol to move illicit funds, confirming it as a favourite destination for cybercriminals due to its decentralised nature that makes centralised blockchain difficult.

In conjunction with these operations, the hacker converted a significant portion of the loot into Monero (XMR), a privacy coin specifically designed to obscure transaction details. This massive buying pressure had a direct and immediate effect on the market: the price of Monero jumped 36% in just seven days, reaching a peak of almost $800, before settling at around $621.

A security emergency: the boom of impersonations

This incident is not an isolated case, but a symptom of a broader security crisis. Hackers are shifting their range of action: instead of attempting to force complex cryptographic protocols, they prefer to target the weakest link in the chain, i.e. the user, through social engineering and impersonation scams.

Data provided by the blockchain analysis company Chainalysis confirm the seriousness of the phenomenon: impersonation-based scams have soared by 1,400% year-on-year. At the same time, the average financial loss per single incident has increased by more than 600%.

Conclusions and lessons for investors

The $282 million theft serves as a warning to the entire crypto community. Despite the use of hardware wallets (considered the gold standard of security), no technology can protect a user who voluntarily hands over his or her private keys. Experts reiterate a fundamental principle: no hardware wallet provider will ever demand the seed phrase from its customers. As the market monitors the movement of funds on Monero and Thorchain, the priority for investors remains one: proactive defence against attempts at psychological manipulation.