Phishing site impersonates Trezor in top Google search result, draining user funds
Via newegg.com
A fraudulent page hosted on Google Sites topped sponsored results for the popular hardware wallet, tricking victims into surrendering recovery phrases.
+15.1% (FY ended 2025-12-31 vs FY ended 2024-12-31) 10-K
Annual net income
132,170,000,000 USD (FY ended 2025-12-31, attributable to the company) 10-K
Annual operating margin
32.0% (FY ended 2025-12-31)
Forward P/E
Unavailable: no dated forecast source
Gloria daily close for session Oct 27, 2026. Market cap and trailing P/E use this close with the SEC share total and trailing diluted earnings, each dated next to its figure. Annual revenue, revenue growth, net income and margin show their own fiscal period and link the 10-K. Current context may postdate this article.
Alphabet Inc. and its peers
Company
Price
Market cap
P/E (trailing)
Forward P/E
Annual revenue (USD)
Annual revenue growth
Annual net income (USD)
Operating margin
Alphabet Inc.
GOOGL · Price dated Oct 27, 2026 · tokenized GOOGLx
3,333,751,000FY ended 2025-12-31, attributable to the company · 10-K
75.8%FY ended 2025-12-31
Missing figures stay unavailable. Forward P/E requires a dated source. Annual revenue, revenue growth, net income and margin come from each company's own 10-K, in US dollars, and each row shows that fiscal year. Revenue growth compares the fiscal year with the prior year stated in the same 10-K. Net income is the full year amount attributable to the company, or available to common stockholders where the filing states only that, or consolidated net income. Each row names its basis. Trailing P/E reads "Not meaningful" when the dated trailing diluted EPS is a loss or zero. An operating margin appears only when the filing states both the operating income and the revenue for the same year.
Sources: SEC filings, Gloria daily closes and CoinGecko. Oldest record refresh: Oct 28, 2026, 4:51 PM EDT. Refresh is not a price or filing date. Each row shows its price date and its annual fiscal period. Peers use industry code and company size, or editorial selection. Market cap multiplies that row price by the company share total the latest SEC filing states for every share class together. Trailing P/E divides it by trailing diluted earnings from SEC filings. Rolled earnings per share are approximate because share counts can change between periods. Both appear only when the SEC data carries its date, so they are estimates at one price date, not synchronized filing valuations. Not investment advice.
Token vs underlying stock
Current comparison for GOOGL. Historical observations may postdate this article.
Split-adjusted regular-session stock closes from the existing Gloria shared history, paired only with an observed token price within 45 minutes of 16:00 New York time. Up to 60 matched sessions. No interpolation or missing-date fill. Weekends and known early closes are omitted. Token units are not adjusted for issuer multipliers or dividend treatment. This compares quoted prices, not fair value, executable premiums or arbitrage returns. Solid line: token. Dashed line: stock. Exact quote times and values appear below. Historical observations. Retrieval refers to the token source. Token quote times use UTC. The fixed cohort shows its oldest member fetch.
Alphabet token vs Alphabet stock: exact source values
Quoted token and share units can have different rights, multipliers and dividend treatment. This is not an executable premium or arbitrage signal.
A phishing site masquerading as Trezor climbed to the top of Google’s sponsored search results on August 7, 2026, siphoning funds from users who were tricked into entering their wallet recovery phrases. The fake page, hosted on Google’s own Sites platform, mimicked Trezor’s legitimate interface closely enough that at least one victim reportedly lost their entire life savings.
How the scam worked
The phishing page was hosted at a URL beginning with sites.google.com/view/start-trezor-suite, which lent it an air of legitimacy that a random domain wouldn’t have carried. Google Sites is a free website builder anyone can use, and hosting a scam there meant the URL at least started with a domain most people instinctively trust.
Once on the page, users were prompted to enter their 12- or 24-word recovery phrases, the master keys to their crypto wallets. Hardware wallets like Trezor generate these seed phrases during initial setup, and anyone who possesses them can reconstruct and drain the wallet from any device, anywhere in the world.
Trezor confirmed it is aware of the incident and is working internally to escalate the matter. The company said it is collaborating with Google to get the fraudulent ad removed and has reminded users of a cardinal rule in crypto security: never share your seed phrase with anyone or any website, ever.
A pattern, not an anomaly
This attack didn’t emerge from a vacuum. Paid search ad fraud targeting crypto users has become a recurring problem throughout 2025 and 2026. In May 2026, a similar scheme involving fake Uniswap sites reportedly cost users more than $400,000.
AI, tech, and the markets they move—in one daily briefing.
Daily. Free. Join 34,000+ readers across crypto, finance, and policy.
Trezor and its community have long flagged the risk of misleading ads that frequently overshadow legitimate search results. Sponsored results appear above organic ones, meaning a well-funded attacker can literally outrank the legitimate company in search results.
Why Google ads remain a weak link
The uncomfortable question this incident raises is about Google’s ad screening process. A phishing page impersonating a well-known financial product made it through whatever review mechanisms exist and landed in the single most visible position on the results page.
For crypto users, the defensive playbook remains the same as it has been for years. Bookmark official sites rather than searching for them. Never enter a recovery phrase into any website. Treat sponsored search results with deep skepticism, especially for anything involving financial products. And remember that a legitimate wallet provider will never, under any circumstances, ask for your seed phrase through a web form.
Disclosure: This article was edited by Editorial Team. For more information on how we create and review content, see our Editorial Policy.
