Guides

Crypto phishing: fake Trezor, Ledger and exchange sites

Any website, app or “support agent” that asks for your recovery phrase (seed phrase) is a scam: Trezor and Ledger never ask for it. Get wallet software only from trezor.io or ledger.com, and type that address in yourself.

Crypto phishing is a copied wallet or exchange page (Trezor, Ledger, MetaMask, Coinbase, Kraken, Bitvavo): a “start”, “login” or “support” page that wants you to restore or verify your wallet. It is after your recovery phrase. Whoever has those words can load your wallet onto their own device and empty it, and crypto that has been sent rarely comes back.

These pages often sit on a free subdomain of a website builder or host: typedream.app, square.site, webflow.io, gitbook.io, workers.dev, pages.dev, vercel.app. A page goes live there in minutes, without its own domain; every Cloudflare Workers account, for instance, gets an address on workers.dev. The platforms are legitimate; the problem is the page, not the platform.

People arrive via an email, text, chat message, phone call, fake “support” account or even a printed letter with a QR code; Trezor and Ledger warn about all of these. In the checks run on this site, crypto is one of the largest groups of phishing.

How to spot it

1
It asks for your recovery phrase.To “restore”, “sync” or “unlock” your wallet. Trezor says any request for your wallet backup, PIN or codes is always a scam. Ledger: never share your 24 words with anyone.
2
The address does not belong to the brand.trezor-suite-start.typedream.app belongs to typedream.app, even if the page calls itself “Trezor.io/start”. Read the address from right to left: the part before the last dot, plus the ending, is the owner. Ledger warns that “ledger.com” can turn up inside an address that is not Ledger’s.
3
A download button outside trezor.io or ledger.com.Trezor says to download Trezor Suite only from the official Trezor website. The Dutch regulator AFM warns that fake wallet apps are built to steal private keys.
4
An error message or a deadline.“Wallet out of sync”, “your device will be deactivated”. Ledger says it cannot and will not deactivate your device.
5
Contact you did not ask for.A text, chat message, call or letter “from” Trezor or Ledger. Trezor treats that as phishing; Ledger never calls or texts and does not send direct messages on social media.
6
“Connect your wallet” or “claim your airdrop”.A site that wants you to sign something, or a free token that suddenly shows up in your wallet. Ledger: never approve a transaction you did not start yourself.

A real example, taken apart

web page on trezor-suite-start.typedream.app

Trezor.io/Start. Welcome! Your wallet is not synced with the network. Click “Restore wallet” and enter your 12- or 24-word recovery phrase to secure your balance.

Why this is fake

The address ends in typedream.app, a website builder, not in trezor.io.
Trezor never asks for your wallet backup; Trezor says any page that does is a scam.
“Not synced” is the excuse. Trezor calls your device’s own screen the source of truth.

What you do

Type the address yourself, or use a bookmark.trezor.io, ledger.com, or your exchange’s address that you already know. Trezor recommends bookmarking known, trusted addresses, such as suite.trezor.io/web.
Not sure? Paste the address into the checker.It checks whether this is a customer page on a free platform (a page like that never gets “safe” from us just because the platform is well known), whether a brand name or words like login and wallet appear, and whether it is on phishing lists already.
An exchange you do not know? Check with the AFM.Since 30 December 2024, crypto service providers need a licence or notification from the AFM or another European supervisor. Not in the AFM register of crypto firms? Be extra careful, says the AFM. Check its warning list too.
Already entered your recovery phrase? Move your crypto now.Trezor says: assume someone else has your backup and move your crypto at once to a wallet with a new backup, created on your own device. Never reuse the old words.
Lost money? Bank and police.Paid through your bank, say to a fake exchange? Tell your bank as soon as possible, as the Dutch police advise. In the Netherlands you book a police report appointment on 0900-8844. Keep the address, screenshots, wallet addresses and transaction IDs.
Report it, even if you lost nothing.Email with a link: forward it as an attachment to valse-email@fraudehelpdesk.nl. Text or chat message: the form of the Fraudehelpdesk, the Dutch fraud helpline (088 - 7867372). The fake page: Google Safe Browsing and the host; for workers.dev, Cloudflare’s abuse form.

Never do this

Type your recovery phrase into a website, form or chat, or read it out to “support”. Ledger says: only ever directly on the device itself.
Install wallet software from a link in an ad, email or message.
Pay a “recovery service” that promises to get your crypto back. The AFM warns about fake recovery outfits that ask for “transaction fees” first.

Dossiers of this kind

5,466 dossiers in our database match this kind — counted by what they are, not estimated. A few:

metamask-login.vercel.app ca-coinsquare--auth--nav.webflow.io binancewallett.blogspot.com cacoinsquarelogin.webflow.io imtoken-biz.org.cn 1kraken-zerkalo.ru krakenn.ink kraken.hexxus.com.ar

See what is being checked now →

Questions people ask

Is typedream.app safe? What about workers.dev or square.site?

The platforms themselves are: website builders and hosts where anyone with an account can make a page. So the platform name says nothing about who made the page. A page there about your wallet, a login or your recovery phrase is not from Trezor, Ledger or your exchange.

Is trezor.io/start legit?

Yes, if the domain is exactly trezor.io: https://trezor.io/start. If anything follows trezor.io before the first slash (trezor.io-start.com, trezor.io.xyz.app), it is not Trezor’s. Nor is a page that calls itself “Trezor.io/start” but sits on a different address. Type the address in yourself.

Will Trezor or Ledger ever ask for my recovery phrase or seed phrase?

No. Trezor says any request for your wallet backup is always a scam. Ledger says to share your 24 words with nobody, under any circumstances. Ledger also never calls or texts you.

I entered my recovery phrase on a fake site. What now?

Use your real device and the official app to create a new wallet with a new recovery phrase, and move your crypto there at once; that is Trezor’s advice. Report it to the Fraudehelpdesk and the police. Already gone? Never pay anyone who promises to get it back.

Unsure about a website, number or e-mail?
Paste it into the checker. Thirty seconds, and you know what others already saw.

Check it now

Sources

Trezor: Scams and phishing · Trezor: Move crypto to a wallet with a new wallet backup · Ledger: Ongoing phishing campaigns · AFM: risks of crypto (in Dutch) · AFM: licence or notification required for crypto services from 30 December 2024 · AFM: register of crypto firms (CASPs) · AFM: warnings (in Dutch) · Fraudehelpdesk: report a fake email (in Dutch) · Fraudehelpdesk: report fraud (in Dutch) · Dutch police: reporting phishing (in Dutch) · Google Safe Browsing: report a phishing page · Cloudflare: reporting abuse · Cloudflare: the workers.dev subdomain

← All guides