Trezor and Ledger customers hit by new postal phishing wave using fake QR authentication checks

On Feb. 13, cybersecurity expert Dmitry Smilyanets reported receiving a fake Trezor-branded letter demanding an "Authentication Check" by Feb. 15 or risk device restrictions, with a QR code leading to a phishing site. The scam, which mislabels Trezor CEO Matěj Žák as "Ledger CEO," targets hardware wallet users whose postal data was exposed in past breaches and attempts to trick them into entering seed recovery phrases. Similar physical letters and QR-based attacks have been reported against Ledger users since at least October last year, following multiple data leaks impacting both Ledger and Trezor customers.