$282M LTC and BTC theft by fake Trezor support (2026-01-10): theft addresses per ZachXBT and downstream wallets
- Scam type: Hack
- Chain: XRP Ledger
- Project or site name: Hardware-wallet holder (fake Trezor support)
- Incident date: 2026-01-10
- Reported: 2026-10-24
- Last updated: 2026-10-24
On 2026-01-10 at about 23:00 UTC (5:00 PM CT), a victim lost 2.05 million LTC and 1,459 BTC, more than $282M, after an attacker posing as Trezor support obtained their hardware-wallet seed phrase. ZachXBT reported the theft and published the attacker's theft addresses (https://t.me/s/investigations/313). The attacker converted much of the LTC and BTC to Monero through instant exchanges and bridged some BTC to Ethereum, XRP Ledger and Litecoin through THORChain. ZachXBT also said North Korean hackers were not involved (CoinDesk, https://www.coindesk.com/b…
Other addresses in this report: ltc1qly43c2prj4c2e85dcspzpjd36jnapnenldnr70, bc1qluxw46r55wf3dnk9c652vrt4duadm3hpuktf86, bc1qpsmh26ja0fzzf286zulmt9eywujc2pggj40wzm, ltc1qrtqtztn9dgdhfq9e6znmqc0fyvnvjrftfqwdcj, ltc1qmaz5dcrxdw84vd6saufp3d2vmeuukauxcnd6zz, ltc1qnt8sgmw3tqrndvze74n8a34ewm2laegyp2j7c9, LdZCPZQpzKVgULNZjNxmZBYa3eJqiJH8gJ, ltc1qnckqymg29x0fsekf3u9q54qf0xhhw80xze5m6q, ltc1qs8pymg0yt7qpmgcjuamzvmyk238ymugk85ejr3, ltc1q0px924x6j5f5xfh02fw9zytpckmwkasq95z9cz, ltc1qpg8zkv7y7lpu70sqxkdz9sjgu3aujy9l2pkqe7, ltc1qc2m8705g7jclf3zl3xqg3pq85kwuucmwy3u9hr, ltc1qxvv5wjqfdpjux4fpttrvxxvw0sy8tny7n0z8q5, bc1q00s7zv6n996wddyxh5fg5sf7h5uddr080n8kln, bc1q88krdz7yy4ny20dpecv25ye7j4tr8caxt54ttl, bc1qgkjems88jyk8hasj9ncspxz093nepdn00vaq0y, bc1qmtnswpscl5e8xn3aqj9wm4vystdjk8w29htejp, bc1qz03a4ccel008nc285kr0fcyq99av88gmemh9k4, rBun9Lewb5dmuwkdvhUxQmCUgU3eP45AgG, 0xf73a4ebc3d0984f166ac215471cc895cb4f5cc21 and 594 more