Bitcoin Forum

I just opened my X account and read this;

https://i.ibb.co/fVkDy4nR/Screenshot-146.png (https://ibb.co/twqLv8xf)
Source (https://x.com/Trezor/status/1937085759028089100)

Yes, you can lose your Bitcoin if you are too hasty in responding, this is definitely not only happening to Trezor as a cold wallet, other cold wallets must also get the same attack and try to trick all of us who have it.

So if you get any email from any party asking for a code or seed phrase from you, never share it, be it from a cold wallet or Hot wallet issuing company, beginners who enter this industry are much more easily fooled, so I suggest you be careful.

Well I can't say for all though, but someone who is elite in the crypto space and understands how important their keys are, they won't be so stupid in sharing it to an email no matter where it's coming from.. the phishing scheme is becoming something else especially with emails.. fact is a good number of people still falls victims to this and the best way to prevent this from happening is to let them know that such things actually exist. I'm happy that trezor shared this as well..it shows how reputable they are and would be in the future....

In as far as this attack (phishing attack or social engineering attack) is old, it is still common today and unfortunately it still catches some victims, most especially since this kind of attacks are from legitimate looking account. But the warning still remains that do not share your phrase or keys with anybody.

One of my other scares from vulnerability like this is the emails of those affected are already exposed to hackers, path of the reason why using online storage method to store your seed phrase or private keys or passwords are considered to be bad

This kind of trick isn’t new, it’s called phishing, and the best way to avoid it is to educate ourselves. Once we know what to watch out for, we’ll be fine.

In fact, if you really want your holdings to be safe, it’s better to have a dedicated computer just for accessing them. A computer with limited applications, because the risk can also come from apps, antivirus software, or anything that connects your PC to a server. That’s where things get risky.

Information is key to safely hold and secure our cryptocurrency from hacks and scams, this information in the OP and related topics in this forum might seem old to some of us with experience but a lot of people are becoming victims because they lack proper knowledge. I never rely on messages on emails when I get them, I have to visit the site to asertain if what was sent is actually from the right source, I never click on what I'm not sure of because of fake emails. Another place to be careful of are social media platforms, they are scammers hubs, people should learn their latest tactics and avoid being their victims.

If you always keep to mind the need never to share your private and sensitive information, you will not have any problem with this type of scams. Even if the emails were sent from the official accounts, the moment they request sensitive information, then it becomes obvious that it is a scam attempt. Fishing may be another plan in a case like this one, they can simply add phishing link to the email that appear like something coming from the official source. Effort should always be made to remain alert at all times in order not to fall for scam of any type.

I do not know the reason scammers are still using this way to scam people. It is like many people are still being victims of this type of phishing attack is my guess.

You are right but there are many people that could fall for this scam. They would have lost their money before they will know that have done something stupid. The scammer will let the site looks like it is Trezor official site, not knowing they are dealing with third party which are scammers. Even Trezor can not ask their customers for their seed phrases or keys.

The information is not new, but if it is created, then some dangers are still relevant for some cryptocurrency holders. Recent news about the CoinMarketCap hack also said that the scammers asked visitors to the resource to connect their wallets. Many newbies will not guess that such large sites or well-known wallets will not ask them for anything, such as entering a seed phrase; on the contrary, they will do it without thinking. Therefore, warnings cannot become outdated, as cryptocurrency is becoming more and more popular, and newbies should know the pitfalls that they can accidentally fall into.

This fraud is indeed not new to us, but seeing that the world has begun to massively adopt Bitcoin from year to year, adoption continues to increase and unfortunately I pay very little attention to asset security literacy that we should actually do continuously, because the thief also makes his efforts never stop.

To make a special computer is certainly very rare but it is a very good effort, it's just that beginners will not see that far, maybe we call it follow-up security.


Asset security literacy must be echoed because in that way to minimize victims, we still see a lot of carelessness and they are not aware that they are being trapped by lowly hackers with tricks like this.

Yes information is a safety key. It doesn't matter of this scamming strategy has been existing or not but the thing is, has it been passed to everyone on the space of cryptocurrency? I'm sure I haven't seen an exact one like this which I think would help newbie's who begins their crypto journey after joining us in this discussion forum. You, I and the rest of us may have either not been aware of this information but due to our level of experience, we could do far detect even an unfamiliar scamming scheme to be scam but newbies will always be left behind. there's every necessity to spread any crypto threats here.

Can anyone explain how a triggered auto reply is harmful and can lead to a breach. Auto replies should be per-generated and if the hackers had no breach there should be no way to make any changes to that reply or slip in some harmful links that can request the user's back up details or how that information will be relayed back to the hackers for them to cause any damage.

I could be wrong, but the way I see it without a breach, there should be no real danger, although caution should still be applied.

- Jay -

Why would someone give their wallet backup no matter it's from a legit or fake representative? The backup is to recover our wallet in the case of losing our hardware wallet or any technical malfunction that makes the device non-responsive.

Anyone who wants to keep their crypto safe should keep it to themselves alone; sharing with anyone is simply asking for trouble.

The scam technique is not new (as others have said), it’s nothing else but a phishing attempt.
What makes some of the attempts more dangerous than the others is how much effort and trickery the attacker puts into them.
For phising emails, attackers focuse on making the email looks as genuine as possible and make it look like it’s coming from the company’s official address.
Trezor claims that there was no breach in their email servers and that the attackers exploited a loophole in their contact form. Not sure how they manged to do that, though!

Any crypto user is supposed t know that he should never share his pk/seeds/wallet files with anyone else.

It is an old scam type as is written in Cryptocurrency scam book (https://chainsec.io/scams/) but I am unsure why Trezor made holes for this attack to happen.

People don't need too deep and advanced knowledge for avoiding such scams.

In addition, they need to read more for knowing about more scam types and past scam events so that they are more well-prepared for avoiding scams.
List of hardware wallet hacks. (https://thecharlatan.github.io/List-Of-Hardware-Wallet-Hacks/)

It seems like such a classic way has happened a lot in the past. It's not a matter of beginners or those who have been in this field for a long time who are likely to be targeted. But those who are knowledgeable and those who are not will be the victims.
As said, a hasty situation can make everything easier to happen to anyone. Scammers always take advantage of such situations to trick their potential victims.
The security of the wallet is in our own hands. The wallet is already designed with security features, but as users, we must also continue to update our knowledge.

The statement on one of the pictures you share OP was a very clear message that needed some more attention by both beginners and experienced people who has been into the crypto space for a very long time because its possible even the experienced folks may fall victims of this fraud, its a very important thing to do that you should always continually keep yourself  updated with security as its a continues process, this is why you sometimes get updates on security features on certain things where by they see that a certain security measure that has been working over time for many turns out that at a point it becomes compromise able.

Not sharing your details with people who pose like they are agents from a certain organization or company representative is one which i consider very basic and expect that by now most persons would have been able to get pass that and know that primarily non of this companies will call or email you to provide them with vital information that can cause a compromise on your account except for fraudulent ones who just wants to really get into your account and compromise it to the point they ripp you of all your assets.

This is not new anymore and I wonder why investors are still not learning about how to keep their wallet safe from hackers. Trezor is a cold wallet and the only way that it can be compromised is through your seed phrase when it is exposed.

Your seed phrase is your wallet and shouldn't be disclosed to anyone because it's your private keys. Which is the reason why people should ignore any email on this aspect. Phishing link should be avoided and don't open any email that you are not expecting to avoid panic into and do the wrong thing.

Yes, there are a couple of threads open about this topic, like this one (https://bitcointalk.org/index.php?topic=5547405) (for those interested in the news).

One of the first things that newbies should learn, more than "not your keys, not your coins", which can be misunderstood, is that they should "never send your keys to anyone else" and "be suspicious when you're requested to connect your wallet anywhere".

As more and more people begin to take an interest on cryptos, and the number of potential victims is higher, we are going to see more and more attacks of this style.

Only the uninformed and newbies will panic and give their seed phrases to messages like this.  This kind of phishing attempt isn't new, it has been lurking in the industry for so long but sadly there are still people falling for this trick.

This forum has been exposing this kind of phishing attack/scamming attempt for years now so this news isn't new to us.  Aside from that, members of this forum always remind readers to not share any important details, especially the seed phrases of our Bitcoin address to protect our funds.  Aside from that service provider of the company always reminds us that they don't ask for anything that can access our funds, we should recognize that when someone is asking for our seed phrases or financial account password, it is a sure thing that this person is a hacker or a scammer.  The same thing with the site that asked for our seed phrases, there is a huge chance that it is a phishing site so be careful and always recognize the red flags to avoid these phishing sites and scammers.

It is really important to know that we can lose our Bitcoin and other cryptocurrencies if we are not careful especially with scam attempts like phishing.

This risk is not just for Trezor all types of crypto wallets both physical and online are targets. Main thing to remember is to never share recovery phrases or private keys with anyone no matter who they say they are because real companies will never ask for this information.

Newcomers to crypto are mostky easier to fool so always be on alert and assume any request for these details is scam. If you get such request it is best to delete it and report it and always go directly to your wallet provider official website if you need help or want to check something.

In fact, due to the 16 billion data breach a few days ago, all of our important accounts, including social media, are in danger. Because those who hacked must have sold the data. And those who bought the data will definitely try to scam and blackmail with that data. Of course, in the last two days, I have received phone calls from about eight United Kingdom numbers. But I have not picked up any phone calls. Maybe these people have tried to hack any of my accounts, I myself do not understand which account they tried to hack. However, we should be careful and not give our personal information to anyone. And if it is a seed phase, then there is no question.

I still don't get if people fail to understand the meaning of private or are they just being naive, or maybe they're charity agencies  ;D the only thing that makes anyone claim ownership of their assets is the fact that they have their seed phrase which is to be kept private irrespective of any fact. And I believe one of the best way of doing that is by using your wallet on an airgapped device except in scenario where you are about to spend these money and for security of your airgapped device you can make transfer to you normal wallet address in you mobile phone for easy disbursement else,  no emails no other internet service should  e operated in you airgapped device.

This strategy of scamming has been around for a long time now. It is not a new trick, so I believe it will hardly work on people who have been in the crypto industry for a long period of time. This strategy of scamming can only work on newbies  and even those newbies who may fall for this kind of trick are usually people who don't know anything before investing in Bitcoin or other cryptocurrencies.

Once someone learns the basics and have the knowledge they will less likely to fall for these kinds of scams, because the warnings are everywhere  and people are aware of the types of trick,even on social media due to the rampant presence of scammers. People are constantly warned not to reply to emails from unknown sources, not to share their seed phrase with anyone or any details and not to click on links from unknown sources.all these kinds of warnings are enough for any newbie. In fact, it's not just in the cryptocurrency space  people are always warned not to respond to emails but also out of crypto industry because scammer at everywhere hunting.

It shouldn't surprise you that not everyone old in crypto space is really aware of phishing mails aside from newbies, Though the scammers, they're not mainly targeting crypto OG's, They're most targeted is the newbies and that's why the scammers responsible for sending out this Phishing mails are not relentless in doing what they're doing, this information is very useful to newbies in the space and also existing crypto enthusiasts that doesn't know what phishing is all about.

It is completely understandable that you are frustrated about people not understanding what private means for seed phrases. These phrases are only way to truly own your crypto so keeping them secret is very important. You have made really strong argument for using air gapped device to keep your digital wallet safe. This means keeping it completely offline only connecting it when you absolutely need to move money to regular online wallet to spend. With stressing that no emails or internet should ever be on that air gapped device this will help to keep it separate from any online dangers.

They must start with leaning and choosing a good wallet software for using.

What is a good wallet software?
- Non-custodial (self-custodial)
- Open-source (reproducible)

Then they can learn and practice proper wallet creation (offline), wallet backup creation and storage (also offline). It is very important to note that they can not either choose a custodial and close source wallet to use, or create wallet online, then make backup online and think their Bitcoin fund will be safe.

Bad practice of any of these steps makes risk factors that possibly results in unsafe Bitcoin fund.

Although, newbies are the most easily category of people that fall for scam like this but even a number of elites in this space sometimes get carried away and end up losing their funds through a similar strategy. At times, it's due to desperation when certain mistakes already happened and in attempt to stop further occurrence, you end up making silly mistakes that lead to more damages. After all the warnings and danger of sharing our keys with others, it's very unfortunate that some people are still not rigid in keeping this practice. Like how will someone convince me to share my private keys in the first place?

Because they feel that the scam attack is legitimate, as sent by Trezor, they use this method... If scammers carry out such scams, it is clear that there are still victims.

Only we ourselves know the wallet backup; no one else should know, including relatives, let alone representatives from the company.
If someone still believes in such a trick, they are likely foolish for allowing others to access their wallet backup.

Those wallets developers will never on earth ask a user to share their private key with them, it's even rare for them to ask for your public keys because they don't have anything to do with it, they have already programmed how the wallets can serve users and if there's any problem being encountered, it would be everyone complaining about it and even when the developers wants to offer help to such general problems, they will fix what ever that needs to be fixed from their own end and not to request for customers private keys. Anybody that is still falling victim to this kind of scam is either a newbie or an enthusiast that has no knowledge of giving out private key to anyone.

If you don't read more about the attack, you'd prolly not understand how the attackers perpetrated the attack. So what they do is they create a fake ticket with a subject title that reads: So when Trezors automated support system replies to this ticket with a generated ticket number and the ticket title as the email subject, the scammers then sends this email to Trezor customers, but of course with the addition of a phishing link.

That said, i don't care how real the scammers make the scam look, you should never share your seed phrase, ever, even if you believe the message is from an official channel. You can read more about this incident here: https://www.bleepingcomputer.com/news/security/trezors-support-platform-abused-in-crypto-theft-phishing-attacks/

Since I got involved with crypto, my security awareness has increased, and I have also been very careful with my dealings online. Everyone who is into cryptocurrencies should, as a matter of fact, have some level of security consciousness. They should always verify every piece of information before acting on it.

I honestly think it is outright stupidity for anyone to share their seed phrase for any reason. Who really doesn't know that this can cost them all their bitcoins?

When investing in Bitcoin, it is one thing to pull out capital to buy bitcoins, and it is another thing entirely to protect those bitcoins from being stolen. Being careless can be costly. Bitcoiners have no excuse for the actions that led to the loss of their bitcoins. As long as they didn’t lose them at gunpoint, it is their fault for not being smart.

Why do you call Trezor a "cold wallet"?

Any wallet that you connect online via cable or wirelessly does not belong to that category and people are just fooling themselves into thinking that their coins are absolutely safe when that is not the case. Besides, the case you describe can happen to any type of crypto wallet, all it takes is that you are naive enough to believe that you need to enter your seed where they tell you to.

If the emails only looks the same but not actually the original then users can avoid that but sometimes its bit tricky since its so identical. But if the scam email triggers the original email of trezor then thats quite scary means that they are compromised.

Scams are typicall evolving hard. So beginners must be cautious enough.

That's why we should have this habit like we try to verify everything especially if we are not sure about those information we receive so that we can assure our safety.

But if we are not really interested with the info we receive and try to ignore any to good to be true promotions out there we better ignore those messages so that we can stay away for any possible issues.

Although newbies is really prone for this hacking or scamming that's why they better need to be more careful dealing the offers they receive online. Since they go on crypto for sure they receive lots of deceptive offers. 

Most scammers today use various media to trap their potential victims, and most of them use service platform media, such as email services, social media, and many others. Most of them take advantage of the openness of information, so they can get access to send some kind of phishing trick to launch their actions, and this is very dangerous if we are not really careful, because most of them make it seem like it comes from a well-known company and imitate it.

So, we have to be careful every time we get information from anywhere, whether it's from email, direct messages from social media, or anywhere else, if we receive the message, we should verify and double-check its truth, or better yet ignore messages that look suspicious and usually the message has characteristics that make us panic or make us interested.

It seems a bit irresponsible they so quickly state there was no E-Mail breach when the phishing E-Mails can easily get the E-Mail addresses just by clever manipulation tactics. Did they even do any research in the time between the two tweets? Their second tweet is just them trying to push off responsibility, because it was obviously their fault they left people's E-Mails vulnerable to attacks. In fact, they might have made the phishing attempts of the attacker even more successful, because the attacker is using their legitimate E-Mail address to fool people.

For example, the attacker can embed tracking pixels or unique links, or the email might contain a link that redirects to a phishing page where you have to enter details or they can even exploit browser plugins to get personal info, like E-Mail addresses.

I think Trezor can be used as a cold storage since it is possible to sign a transaction offline with it and broadcast separately to the bitcoin network. You can go ahead and create an unsigned transaction with electrum wallet, the unsigned transaction would be saved a PSBT (Partially Signed Bitcoin Transaction). Then you can go ahead connect Trezor to a computer and use the wallet software to sign the transaction without the internet.

After that you can send it to the network using online broadcasters like Electrum, mempool.space, e.t.c

Here is more info I found upon my research on how to sign it.
https://www.reddit.com/r/TREZOR/comments/4mczab/is_it_possible_with_trezor_to_sign_a_transaction/

I believe the easiest people to cash are those novice that act on email, using Links they did not request for to implement anything on their account like one email I received sometimes ago, about log in and I from the interface I discovered this is not how the original website log in look like.


So if you are not careful, once you submit any personal details like your wallet key's or password on the link the hacker through that phishing link gets all information that you have input.

Hardware wallets are safe but sometimes those can also get hacked and one might end up losing his/her Bitcoin during such incidence. Companies like Trezor try their best to make their users aware via such X posts and it's still on user's own smartness level to safe his/her assets from those hackers and scammers. These days scammers are everywhere and one who doesn't understand a thing should always try to stay away from such scammers at any cost. Only awareness and education can protect someone from such attacks and that's why some smart people say that don't share your private keys, your seed phrases or such level of private details to anyone. Not even with the ones whom you trust.

Of course you can lose your bitcoin, that is why it is good to use a strong password and be careful of scammers.

Bitcoin is one of the hottest assets anybody can have, that is why you must careful.
Backup your wallet regularly
Keep your private keys secure and private

To any bitcoiner who has little or full knowledge about how Crypto/Bitcoin works ought to have known that the private key of a Bitcoin wallet is one thing that must not be shared to a third party, not even the company that owns the non custodial wallet. And as such, coming across an email requesting for your wallet private, you ought to have known that this is 100% scam, and avoid it, as I'm pretty sure it's only Newbies who are likely to fall for this scam, which is why I always advocate that whoever wishes to invest in Bitcoin, should also strive to invest in knowing it's basic security measures and how to prevent losing your funds due to errors.

I usually receive these scam emails pretending to be a support for Trezor and even Ledger. These emails are very common; these scammers have a script and database of our emails that have been breached before, and they just keep on emailing these victims, testing their luck until someone falls for it. Just never click the link that's attached at the end of the emails because that's the next step on how they're going to scam everyone and take the victims' seeds. That is why it's important as users that we need to be vigilant to these tactics and always verify through the sender if they're a genuine one.

I don't know how some of these scammers have access to email addresses or some of the platforms where we register do sell our emails to these scammers. I'm worried because the number of scam emails I receive sometimes are just too much. Of not that I'm a little experienced and always careful to discern these emails, it would have been very difficult to avoid all the scam attempts.

Getting informed and updated are the keys. You won’t fall into any type of scam if you are getting the right information and if you are aware in the first place on how security works with crypto. Otherwise, if you think you still have a lot to learn with crypto, then take your time and be open for new ideas and insights.

Learning is not just gained once or twice, you have to make it a day to day learning achievement. That’s why patience is a must.

It is not about knowledge relating to crypto, but to using technology and not being naive. If you won't fall for traditional scams, you won't fall for crypto scams. A sane user will always educate themselves properly before using something, which sadly can't be said for most people. Scams are successful because people use things without knowing anything about how they work. Most people don't know anything about the internet, that is why the scam industry is so strong. There are professional groups that are trying to scam 24/7.

It make the users of that particular wallets to do all the necessary things that will make their wallets safe and secure for long period of years.  It will be difficult for any wallets official to demand for your personal details that is your key to your wallet, and even before you start processing the necessary things that will give you access to your wallet the wallets official will alert their customers or users not to share their privacy with anybody that will come or send message to them to require for their key.

When you keep learning without seeing yourself as someone that know it all in the crypto industry, I guess you will not be scam, because you have the knowledge to identify the type of people you are dealing with in the industry.

Using a strong password does not protect you from this scam, if you give a scammer your seed phrase they'll steal your bitcoins, your password is only for local security against physical attacks, on your own device.
You don't have to back up your wallet "regularly", all you basically have to do is make a good back up for your wallet and keep it in at least two places, you can decide to either back it up on paper or on steel.

What you wrote is true, but you can achieve the same thing with an even better level of security if you install Electrum on a computer that is offline, and then create a watch-only wallet on a computer that is online. That would be a cold + air-gapped wallet by definition, while with Trezor you still have to connect it online when you install firmware and coin apps (unless there is a way to do it via SD card).

Simply put, anything that has direct contact with the internet is not a cold wallet.

This is the reason too why still others lose their bitcoins or even other coins because of the accounts or server gets compromise and people who are really engage into it don't want to get late with the updates so they make an engagement and also wondering if the Trezor also have an immediate take action on it, but its sad to those who stole their funds its a one way transaction no taken back their funds considered as charge to experience and its agonizing the same time.

Just ignore and block them upon reading. Or don't take the time to read them. You know how they start with the opening clause of their emails, they're all the same, so don't fall for it. And just remember one thing with these hardware wallet companies, they will never ask for your recovery phrases. While these scam emails, they'll ask you for that so that they can help you fix the broken wallet which is just a false reasoning for you to fall for that scam.

The information is an old one but the problem is that the information is very necessary to people who have come across of this kind of thread, not knowing that our keys is one of the major priorities in cryptocurrencies because when you lose your keys you will not have access to your keys and people you don't know who have access to your keys will withdraw your coins, so that's why I said that the information is relevant because it's information of security, so without that many people will not see their keys as important one, so therefore we have to understand the such theories of know your key because it's important to everyone.

If you want to keep your wallet information safe, then you should not click on any kind of link because you can lose your information. If you notice that your device is infected with a virus, then you should understand that your files can be stolen, so be careful. You can always use known exchanges such as Binance, Coinbase, you can definitely trust large trusted exchanges that will keep your assets safe.

Please do not give this sort of advice that is completely wrong, so you don't mislead newbies. Under no circumstances should you use any exchange to hodl your funds, "not your keys, not your funds" is like the most used phrase in the network, but yet people still give this sort of advice and many others still use centralized exchanges to hodl their funds. The only safe place for your assets is your non-custodial wallet, at least if you're going to be your own bank, it is on your to take responsibility for your assets.

This is obviously beginner's advice that should not be taken seriously - but a lot of people somehow equate CEXs with traditional banks where they keep their money because it is safer than keeping it at home where thieves can steal it at any time. You will have a hard time getting that idea out of their heads because it has been like that for hundreds of years and the system still encourages people to keep their money in banks.

One of the CEOs of the aforementioned CEXs publicly states that 99% of people are not capable of guarding their cryptocurrencies and will lose them sooner or later. Considering the influence it has among the masses, it should not be surprising that people still think that CEXs should be used as some kind of crypto bank.

The famous CZ, lol. His idea sounds crazy to quite a lot of us in this forum, but we'd be shocked at the number of people who actually believe him and would give up the custody of their assets because CZ and binance would offer them better protection against attacks. This same CEO has also brough another idea on how to allure people to leave their funds in binance, through drawing them an inheritance plan, you've read about that one right.

Being too hasty is 99% of the time the reason why people get scammed or lose their coins by accident, even for veterans who have far more experience than most of the people in this forum.

Scams or accidents can happen to anyone at any time. We get too relaxed by routine things and end up losing focus.

And phishing scams are not the only ways people lose their money.  For example, the copy/paste clipboard injection of a similar but different address. One moment of getting caught off-guard and your money is gone forever.

You rarely know much about safety in this area so you should do more of study than offering advise because this information you are giving is somehow misleading. How can you advise someone to use centralized exchanges such as Binance and Coinbase for storing their cryptocurrency? Have you forgotten what happened to Mt.Gox, FTX, and other exchanges where people lost their money. If you want to story your Bitcoin safely, use hardware wallets and where you must use software wallets, use wallets that are open source for better security. You can use Electrum and I also head Blue wallet is also good.

You are completely right to point out dangers of storing crypto on centralized exchanges like Binance or Coinbase past events like Mt. Gox and FTX show that even big exchanges can fail and cause people to lose all their money because they control your private keys.

For true security it is best to use hardware wallet which keeps your crypto offline or if using software wallet choose open source options like Electrum or Blue Wallet as their public code makes them safer. It is crucial for everyone to understand that if you have control of your own crypto wallet keys so you are is safe you have protected your investments.