Fake Trezor Suite (dappconnectflow.com, promoted via hijacked Google Ads and a Google Sites page) harvesting recovery seeds, late Oct 2026 On-chain trace of the BTC side: TWO collector addresses, not one. bc1qxaps2p... (reported here by several victims, 39 payments, 3.32 BTC) and bc1q0vthag... (NOT reported so far, 56 payments, 8.17 BTC). Both were swept on 31 Oct 2026 (tx dd1a3efc..., 56 inputs, and 4afd9e17..., 33 inputs) into a stage-2 address bc1q6fnven..., from which the operator peels off amounts: 2.0 BTC to bc1qpydn5..., 2.86 BTC to bc1qxsscc48..., 1.54 BTC cashed out via a custodial service. As of 3 Nov 2026, 8.87 BTC remain unspent on bc1q6fnven..., bc1qxsscc48... and bc1qpydn5.... All three peel transactions share one wallet fingerprint (v1, locktime 0, RBF, flat 564 sat fee). Note for tracers: the cash-out service's hot wallet spends victim deposits together with its own funds; outputs of those transactions are customer payouts, not attacker funds. Full write-up with graphs: https://coinator.eu/en/coinator/blog/trezor-phishing-google-ads/