On Jan. 10, 2026, a bitcoin and litecoin holder handed over their 12-word recovery phrase to someone posing as Trezor support and watched $282 million vanish in minutes. No encryption was broken. The words themselves are the wallet, and whoever holds them holds the funds.
The theft, documented by on-chain investigator ZachXBT, drained 1,459 bitcoin and 2.05 million litecoin from a single victim. The attacker impersonated Trezor customer support, manipulated the target into revealing the seed phrase, and immediately began laundering the proceeds through instant exchanges including Thorchain, bridging bitcoin into ethereum, ripple, and litecoin before converting a significant portion into monero. ZeroShadow, a cybersecurity firm tracking the outbound flows, froze over $1 million before it could be swapped into XMR, but the bulk of the assets moved unimpeded.
A seed phrase, typically 12 or 24 words, is the human-readable master key that generates every private key and address a wallet will ever use. It is not a password. It cannot be reset. If it is photographed, typed into a notes app, saved to a cloud drive, or emailed to oneself, it has entered a digital environment where malware such as SparkKitty — mobile spyware found on both Apple's App Store and Google Play — uses optical character recognition to scan photo galleries for 12-word combinations and exfiltrate them to attacker-controlled servers.