Snail mail letters target Trezor and Ledger users in crypto-theft attacks

A phishing campaign is mailing letters that impersonate Trezor and Ledger, instructing recipients to scan QR codes for a supposed "Authentication/Transaction Check"; the QR codes lead to phishing sites that ask for hardware wallet recovery phrases and transmit them to an attacker-controlled API endpoint (e.g., https://trezor.authentication-check.io/black/api/send.php). The campaign leverages physical mail to create urgency and trust, has produced live phishing domains (one flagged by Cloudflare), and threatens complete loss of funds for any user who submits their seed phrase.