You can lose your Bitcoin

[Royal Cap]

In fact, due to the 16 billion data breach a few days ago, all of our important accounts, including social media, are in danger. Because those who hacked must have sold the data. And those who bought the data will definitely try to scam and blackmail with that data. Of course, in the last two days, I have received phone calls from about eight United Kingdom numbers. But I have not picked up any phone calls. Maybe these people have tried to hack any of my accounts, I myself do not understand which account they tried to hack. However, we should be careful and not give our personal information to anyone. And if it is a seed phase, then there is no question.

[Makus]

I still don't get if people fail to understand the meaning of private or are they just being naive, or maybe they're charity agencies  the only thing that makes anyone claim ownership of their assets is the fact that they have their seed phrase which is to be kept private irrespective of any fact. And I believe one of the best way of doing that is by using your wallet on an airgapped device except in scenario where you are about to spend these money and for security of your airgapped device you can make transfer to you normal wallet address in you mobile phone for easy disbursement else,  no emails no other internet service should  e operated in you airgapped device.

[SOKO-DEKE]

Yes, you can lose your Bitcoin if you are too hasty in responding, this is definitely not only happening to Trezor as a cold wallet, other cold wallets must also get the same attack and try to trick all of us who have it.

So if you get any email from any party asking for a code or seed phrase from you, never share it, be it from a cold wallet or Hot wallet issuing company, beginners who enter this industry are much more easily fooled, so I suggest you be careful.

This strategy of scamming has been around for a long time now. It is not a new trick, so I believe it will hardly work on people who have been in the crypto industry for a long period of time. This strategy of scamming can only work on newbies  and even those newbies who may fall for this kind of trick are usually people who don't know anything before investing in Bitcoin or other cryptocurrencies.

Once someone learns the basics and have the knowledge they will less likely to fall for these kinds of scams, because the warnings are everywhere  and people are aware of the types of trick,even on social media due to the rampant presence of scammers. People are constantly warned not to reply to emails from unknown sources, not to share their seed phrase with anyone or any details and not to click on links from unknown sources.all these kinds of warnings are enough for any newbie. In fact, it's not just in the cryptocurrency space  people are always warned not to respond to emails but also out of crypto industry because scammer at everywhere hunting.

[Franctoshi]

Well I can't say for all though, but someone who is elite in the crypto space and understands how important their keys are, they won't be so stupid in sharing it to an email no matter where it's coming from.. the phishing scheme is becoming something else especially with emails.. fact is a good number of people still falls victims to this and the best way to prevent this from happening is to let them know that such things actually exist. I'm happy that trezor shared this as well..it shows how reputable they are and would be in the future....

It shouldn't surprise you that not everyone old in crypto space is really aware of phishing mails aside from newbies, Though the scammers, they're not mainly targeting crypto OG's, They're most targeted is the newbies and that's why the scammers responsible for sending out this Phishing mails are not relentless in doing what they're doing, this information is very useful to newbies in the space and also existing crypto enthusiasts that doesn't know what phishing is all about.

[ThemePen]

I still don't get if people fail to understand the meaning of private or are they just being naive, or maybe they're charity agencies  the only thing that makes anyone claim ownership of their assets is the fact that they have their seed phrase which is to be kept private irrespective of any fact. And I believe one of the best way of doing that is by using your wallet on an airgapped device except in scenario where you are about to spend these money and for security of your airgapped device you can make transfer to you normal wallet address in you mobile phone for easy disbursement else,  no emails no other internet service should  e operated in you airgapped device.

It is completely understandable that you are frustrated about people not understanding what private means for seed phrases. These phrases are only way to truly own your crypto so keeping them secret is very important. You have made really strong argument for using air gapped device to keep your digital wallet safe. This means keeping it completely offline only connecting it when you absolutely need to move money to regular online wallet to spend. With stressing that no emails or internet should ever be on that air gapped device this will help to keep it separate from any online dangers.

[SilverCryptoBullet]

It is completely understandable that you are frustrated about people not understanding what private means for seed phrases. These phrases are only way to truly own your crypto so keeping them secret is very important. You have made really strong argument for using air gapped device to keep your digital wallet safe. This means keeping it completely offline only connecting it when you absolutely need to move money to regular online wallet to spend. With stressing that no emails or internet should ever be on that air gapped device this will help to keep it separate from any online dangers.

They must start with leaning and choosing a good wallet software for using.

What is a good wallet software?
- Non-custodial (self-custodial)
- Open-source (reproducible)

Then they can learn and practice proper wallet creation (offline), wallet backup creation and storage (also offline). It is very important to note that they can not either choose a custodial and close source wallet to use, or create wallet online, then make backup online and think their Bitcoin fund will be safe.

Bad practice of any of these steps makes risk factors that possibly results in unsafe Bitcoin fund.

[knowngunman]

Well I can't say for all though, but someone who is elite in the crypto space and understands how important their keys are, they won't be so stupid in sharing it to an email no matter where it's coming from.. the phishing scheme is becoming something else especially with emails.. fact is a good number of people still falls victims to this and the best way to prevent this from happening is to let them know that such things actually exist. I'm happy that trezor shared this as well..it shows how reputable they are and would be in the future....

Although, newbies are the most easily category of people that fall for scam like this but even a number of elites in this space sometimes get carried away and end up losing their funds through a similar strategy. At times, it's due to desperation when certain mistakes already happened and in attempt to stop further occurrence, you end up making silly mistakes that lead to more damages. After all the warnings and danger of sharing our keys with others, it's very unfortunate that some people are still not rigid in keeping this practice. Like how will someone convince me to share my private keys in the first place?

[BABY SHOES]

I do not know the reason scammers are still using this way to scam people. It is like many people are still being victims of this type of phishing attack is my guess.

Because they feel that the scam attack is legitimate, as sent by Trezor, they use this method... If scammers carry out such scams, it is clear that there are still victims.

Why would someone give their wallet backup no matter it's from a legit or fake representative? The backup is to recover our wallet in the case of losing our hardware wallet or any technical malfunction that makes the device non-responsive.

Anyone who wants to keep their crypto safe should keep it to themselves alone; sharing with anyone is simply asking for trouble.

Only we ourselves know the wallet backup; no one else should know, including relatives, let alone representatives from the company.
If someone still believes in such a trick, they are likely foolish for allowing others to access their wallet backup.

[Mrbluntzy]

Those wallets developers will never on earth ask a user to share their private key with them, it's even rare for them to ask for your public keys because they don't have anything to do with it, they have already programmed how the wallets can serve users and if there's any problem being encountered, it would be everyone complaining about it and even when the developers wants to offer help to such general problems, they will fix what ever that needs to be fixed from their own end and not to request for customers private keys. Anybody that is still falling victim to this kind of scam is either a newbie or an enthusiast that has no knowledge of giving out private key to anyone.

[Coyster]

If you don't read more about the attack, you'd prolly not understand how the attackers perpetrated the attack. So what they do is they create a fake ticket with a subject title that reads:

[URGENT]: vault.trezor.guide - Create a Trezor Vault now in order to secure assets who may potentially be at risk.

So when Trezors automated support system replies to this ticket with a generated ticket number and the ticket title as the email subject, the scammers then sends this email to Trezor customers, but of course with the addition of a phishing link.

That said, i don't care how real the scammers make the scam look, you should never share your seed phrase, ever, even if you believe the message is from an official channel. You can read more about this incident here: https://www.bleepingcomputer.com/news/security/trezors-support-platform-abused-in-crypto-theft-phishing-attacks/

[Floxynice]

Since I got involved with crypto, my security awareness has increased, and I have also been very careful with my dealings online. Everyone who is into cryptocurrencies should, as a matter of fact, have some level of security consciousness. They should always verify every piece of information before acting on it.

I honestly think it is outright stupidity for anyone to share their seed phrase for any reason. Who really doesn't know that this can cost them all their bitcoins?

When investing in Bitcoin, it is one thing to pull out capital to buy bitcoins, and it is another thing entirely to protect those bitcoins from being stolen. Being careless can be costly. Bitcoiners have no excuse for the actions that led to the loss of their bitcoins. As long as they didn’t lose them at gunpoint, it is their fault for not being smart.

[Lucius]

~snip~
Yes, you can lose your Bitcoin if you are too hasty in responding, this is definitely not only happening to Trezor as a cold wallet, other cold wallets must also get the same attack and try to trick all of us who have it.

Why do you call Trezor a "cold wallet"?

Any wallet that you connect online via cable or wirelessly does not belong to that category and people are just fooling themselves into thinking that their coins are absolutely safe when that is not the case. Besides, the case you describe can happen to any type of crypto wallet, all it takes is that you are naive enough to believe that you need to enter your seed where they tell you to.

[cryptoaddictchie]

If the emails only looks the same but not actually the original then users can avoid that but sometimes its bit tricky since its so identical. But if the scam email triggers the original email of trezor then thats quite scary means that they are compromised.

Scams are typicall evolving hard. So beginners must be cautious enough.

[ultrloa]

If the emails only looks the same but not actually the original then users can avoid that but sometimes its bit tricky since its so identical. But if the scam email triggers the original email of trezor then thats quite scary means that they are compromised.

Scams are typicall evolving hard. So beginners must be cautious enough.

That's why we should have this habit like we try to verify everything especially if we are not sure about those information we receive so that we can assure our safety.

But if we are not really interested with the info we receive and try to ignore any to good to be true promotions out there we better ignore those messages so that we can stay away for any possible issues.

Although newbies is really prone for this hacking or scamming that's why they better need to be more careful dealing the offers they receive online. Since they go on crypto for sure they receive lots of deceptive offers. 

[Patikno]

Most scammers today use various media to trap their potential victims, and most of them use service platform media, such as email services, social media, and many others. Most of them take advantage of the openness of information, so they can get access to send some kind of phishing trick to launch their actions, and this is very dangerous if we are not really careful, because most of them make it seem like it comes from a well-known company and imitate it.

So, we have to be careful every time we get information from anywhere, whether it's from email, direct messages from social media, or anywhere else, if we receive the message, we should verify and double-check its truth, or better yet ignore messages that look suspicious and usually the message has characteristics that make us panic or make us interested.

[goldkingcoiner]

It seems a bit irresponsible they so quickly state there was no E-Mail breach when the phishing E-Mails can easily get the E-Mail addresses just by clever manipulation tactics. Did they even do any research in the time between the two tweets? Their second tweet is just them trying to push off responsibility, because it was obviously their fault they left people's E-Mails vulnerable to attacks. In fact, they might have made the phishing attempts of the attacker even more successful, because the attacker is using their legitimate E-Mail address to fool people.

For example, the attacker can embed tracking pixels or unique links, or the email might contain a link that redirects to a phishing page where you have to enter details or they can even exploit browser plugins to get personal info, like E-Mail addresses.

[DubemIfedigbo001]

~snip~
Yes, you can lose your Bitcoin if you are too hasty in responding, this is definitely not only happening to Trezor as a cold wallet, other cold wallets must also get the same attack and try to trick all of us who have it.

Why do you call Trezor a "cold wallet"?

Any wallet that you connect online via cable or wirelessly does not belong to that category and people are just fooling themselves into thinking that their coins are absolutely safe when that is not the case. Besides, the case you describe can happen to any type of crypto wallet, all it takes is that you are naive enough to believe that you need to enter your seed where they tell you to.

I think Trezor can be used as a cold storage since it is possible to sign a transaction offline with it and broadcast separately to the bitcoin network. You can go ahead and create an unsigned transaction with electrum wallet, the unsigned transaction would be saved a PSBT (Partially Signed Bitcoin Transaction). Then you can go ahead connect Trezor to a computer and use the wallet software to sign the transaction without the internet.

After that you can send it to the network using online broadcasters like Electrum, mempool.space, e.t.c

Here is more info I found upon my research on how to sign it.

Yes, use electrum.

Send tab -> fill info -> click send - make sure all is fine here, click sign - confirm on trezor - click save instead of broadcast. Save the file to pendrive or something

https://www.reddit.com/r/TREZOR/comments/4mczab/is_it_possible_with_trezor_to_sign_a_transaction/

[Ojima-ojo]

In as far as this attack (phishing attack or social engineering attack) is old, it is still common today and unfortunately it still catches some victims, most especially since this kind of attacks are from legitimate looking account. But the warning still remains that do not share your phrase or keys with anybody.

One of my other scares from vulnerability like this is the emails of those affected are already exposed to hackers, path of the reason why using online storage method to store your seed phrase or private keys or passwords are considered to be bad

I believe the easiest people to cash are those novice that act on email, using Links they did not request for to implement anything on their account like one email I received sometimes ago, about log in and I from the interface I discovered this is not how the original website log in look like.


So if you are not careful, once you submit any personal details like your wallet key's or password on the link the hacker through that phishing link gets all information that you have input.

[SamReomo]

Hardware wallets are safe but sometimes those can also get hacked and one might end up losing his/her Bitcoin during such incidence. Companies like Trezor try their best to make their users aware via such X posts and it's still on user's own smartness level to safe his/her assets from those hackers and scammers. These days scammers are everywhere and one who doesn't understand a thing should always try to stay away from such scammers at any cost. Only awareness and education can protect someone from such attacks and that's why some smart people say that don't share your private keys, your seed phrases or such level of private details to anyone. Not even with the ones whom you trust.

[Redley555]

Of course you can lose your bitcoin, that is why it is good to use a strong password and be careful of scammers.

Bitcoin is one of the hottest assets anybody can have, that is why you must careful.
Backup your wallet regularly
Keep your private keys secure and private