Phishing campaigns have grown more surgical. Researchers at Kaspersky documented a malware framework called OkoBot with a component named SeedHunter that injects a fake recovery-phrase screen inside the genuine Trezor Suite or Ledger Live application once a computer is infected. The infection vector is often a ClickFix-style prompt or a trojanized open-source tool hosted on GitHub. Separately, physical letters bearing holograms and QR codes have been mailed to Trezor and Ledger owners, directing them to phishing sites that mimic official setup pages. Trezor and Ledger have repeatedly stated they never ask users to share recovery phrases through email, physical mail, or websites.
Hardware wallets remain the strongest form of self-custody for average holders, according to Trezor Chief Commercial Officer Danny Sanders, who noted that a stripped-down iPhone introduces more attack surface through Wi-Fi, Bluetooth, iMessage, and cellular connectivity. Still, the Coldcard episode underscores that open-source firmware can be audited by both defenders and attackers, and AI-assisted code review may now find hidden bugs faster than human experts. Coinkite CEO Rodolfo Novak said the company considers AI the most likely explanation for how the five-year-old flaw was discovered, though no direct proof exists.