Trezor Phishing Ad and BTCPay Exploit Hit BTC Holders

Bitcoin users took a serious hit this week after two separate security incidents drained funds and forced an emergency software patch. A fake Google search advertisement impersonated wallet maker Trezor, leading one user to a phishing site. The victim typed their recovery seed into the page, losing roughly 1.6 million dollars in Bitcoin. On chain data shows the attackers quickly moved the stolen coins to a fresh address.

Trezor confirmed the hardware itself was secure, noting that the attack succeeded only because the seed phrase left the physical device. The company urged users to double check website addresses and to never type backup phrases into online forms. Google has not yet explained how the fraudulent ad passed its review checks.

At the same time, the team behind BTCPay Server rushed out an urgent patch for a critical vulnerability already facing active exploitation. Merchants using the open source software received warnings to update to version 2.4.2 immediately or shut down their servers. Security researchers discovered the bug, which can cause direct fund losses if left unpatched.

Beyond updating the main software, operators must also refresh access credentials and move any hot wallet funds to new locations. Neither incident compromised the underlying Bitcoin protocol. Instead, both attacks targeted the human habits and auxiliary software surrounding self custody. Traders should watch for further updates from merchant networks and stay extra vigilant with search engine ads.