Trezor warning about new wave of fraudulent emails.

[PrivacyG]

At this point I believe this warning about fraudulent emails from Trezor, Ledger et cetera should be pinned considering how often I see a new Topic about them.

Edit.  I forgot there was already a Topic made by Mitchell for this kind of warnings and scams (https://bitcointalk.org/index.php?topic=5590142.0).

[Oshosondy]

At this point I believe this warning about fraudulent emails from Trezor, Ledger et cetera should be pinned considering how often I see a new Topic about them.

I think Trezor and Ledger supposed to be giving those forums and social media money to sponsor anti-phishing, but they are only sending emails, but they also post it on X. I do not think this forum will just pin such thread if the hardware companies do not request for it.

[osasshem]

It has turned out to be that the hardware wallets users are now being a target of hackers now, and this will be for the moment because of the breach that has occurred in the crypto wallets recently. This breach I am sure has made a mess in the privacy of those using these sets of wallets, and they will see more of things related.

A more safer and secure way for trezor users to stay safe in situations like this is for them always community with the Trezor team through their official platforms like X or report anything they feel suspicious.

[Z-tight]

It has turned out to be that the hardware wallets users are now being a target of hackers now, and this will be for the moment because of the breach that has occurred in the crypto wallets recently.

Phishing attacks are very common in the community, so many crypto users have at one time or the other reveived similar emails from scammers. Sometimes they randomly send this message and you can receive one in your email box, even if you have never bought a device from that manufacturer.

However, this attack is targeted, after Trezor's logistics partner, ShipMonk leaked shipping details of Trezors customers, and now the attackers actually know who has actually bought a Trezor device in the last 90 days.

[PrivacyG]

I think Trezor and Ledger supposed to be giving those forums and social media money to sponsor anti-phishing, but they are only sending emails, but they also post it on X. I do not think this forum will just pin such thread if the hardware companies do not request for it.

I do not think they should give Bitcoin Talk money for sponsoring anti phishing campaigns.  Phishing is so often heard of that it is pretty much silly to fall for it.  It has been going on and on for decades already in various forms, from calls to SMS and now emails.  You can not stop stupid as far as I can see.  The signs are all around and as simple as looking up their website or X account.

[adultcrypto]

This is real, members are also facing the same issue, https://bitcointalk.org/index.php?topic=5591152.60

Most of us preferred Trezor over any other wallets, and the data lost that day definitely had some members of this forum as well. So everyone should give importance to this matter because not just the emails were breached, the addresses were also breached so everyone should stay super alert especially if they are living in France because the wrench attacks have usually been more there than other places.

Always secure your funds somewhere else than home if that's possible, one member on other forum Philipma was saying he secures he keys in lockers instead of home which is a good idea but he did not give much information either he encrypts them or not but that does not matter because its security thing, you never have to give full information so always encrypt your data, if it is important. And secure it in multiple places and keep some for the thieves as well if possible.

Can you give more details on how Trezor wallets were also compromised in the recent turn of events? If they got access to the email of users, I feel they might have also gotten more information or access to more than just the email of users and this is why I'm asking for more information.

Do you think encryption is enough to protect users in some of these security challenges especially now that what used to be the best wallets are becoming the target of hackers?

[Italian Panic]

Unfortunately, this is what lies ahead for us in the near future. Cryptocurrencies are under attack from those who do not want this kind of freedom, just as certain open source systems are periodically under attack; governments are very adept at playing these little games to undermine the credibility of these tools, and who knows what else.

[X-ray]

Expected this to happen when their customer data got breached, after all those hackers won't be hacking those data without doing something about it.

Email will be biggest attack vector when data breaches are going up. I think that company like Trezor needs to take extra step to ensure their users won't fall to phishing by doing PGP signed email or something.

I'm sure there is something we can do to minimize risks of phishing, the phishing attack whenever data breaches occurred is too dangerous to ignore and average people might have a hard time keeping themselves updated and avoid the phishing mails.

[Free Market Capitalist]

Most of us preferred Trezor over any other wallets, and the data lost that day definitely had some members of this forum as well. So everyone should give importance to this matter because not just the emails were breached, the addresses were also breached so everyone should stay super alert especially if they are living in France because the wrench attacks have usually been more there than other places.

Well, actually, the great thing about Trezor is that it deletes or anonymizes its customers' data after 90 days, unlike Ledger.

However, this attack is targeted, after Trezor's logistics partner, ShipMonk leaked shipping details of Trezors customers, and now the attackers actually know who has actually bought a Trezor device in the last 90 days.

Exactly. It's a bummer, but at least the impact is limited.

Unfortunately, this is what lies ahead for us in the near future. Cryptocurrencies are under attack from those who do not want this kind of freedom...

I wouldn't say "cryptocurrencies" I think rather Bitcoin self-custody is under attack but you can call me a conspiracy theorist or whatever.

[HajiBagi]

Trezor in X is warning about a new wave of fraudulent emails. Apparently, the scammers have decided to play on the fears of those who haven’t yet heard about what happened with ColdCard.

I never rely on notifications in my email for updates. I can receive and read emails but for important things, I will double check with the official website, social media accounts of that company to see whether what I received in emails is true before doing any further actions.

Quickly believe in anything, without double checks, and take action immediately is very risky.

Please can you provide link to the blog post or X link? Thanks in advance.

It's not on Trezor's wall but you can find it with Trezor's latest replies.

This is that post.
https://x.com/Trezor/status/2092228166823682261

I think we have the same thing in common, i find it difficult to rely on any notification i received from my email or anywhere else, because there are many ways people got scammed these days, if i receive any notification link on email I make sure i check on official website and ensure the information is correct, if the information is not that important, i will forget about it, because sometimes they can claim that their website was hacked or something wrong.

Not all notifications we received in our email are from the company or the website, sometimes we have to ignored them and pretend we don’t see it if the information is not important, because anything can happen with the website, and if it hacked and if you are among the victims you are the one to blame for your actions because as an investor, you should have an experience of what you should do and not do.

[ImGenius]

~~~~

If the email data of Trezor newsletter subscribers has been breached then this is a very big problem because most users who subscribed to the Trezor newsletter are trezor user or somewhat connected to crypto.

If scammers use every scamming techniques on these email addresses many innocent users will fall for them. Every trezor newsletter subscriber needs to be very careful from now on because scammers could target them at any time.

[Agathamay]

this is a clear sign that, scammers are always working tirelessly and these scammers are most times very much informed  and that is why, everyone really needs to take their safety and security very serious because i have also come to realize no one is even above been scammed and this very phishing scam method have always been there and of recent i heard of a case where some group of scammers were caught impersonating the FBI and i was very concerned n how these people get to convince their victims and get to take money from the.

we should always try to verify every link and email we receive from official website else we might just fall victim of what we might not expect.

[PERtua]

The threat in this phishing attack is that it takes the credibility from an actual security incident that has occurred. People who just saw an email about the entropy issue with the Coldcard wallet might think that's the same issue with Trezor. This is the reason why terms such as technical should be taken with a pinch of salt and verified. Trezor has explicitly confirmed that the vulnerability does not affect Trezor's devices and wallets created with the Trezor. The best way to deal with an unexpected security email is to treat it as suspicious and double check with the official channels of Trezor before acting. Here is an explanation that's technically right, but still entirely incorrect.

[Somegory]

The answer is still in that message, not good enough to get someone like me, why? Because every crypto platforms that accept KYC for full functioning has no business with my hardware wallet.

You don't get? Just because I passed KYC on Binance exchange for example doesn't mean that I told Binance exchange that I have Trezor wallet, so if Trezor itself claimed data breach it still makes no sense.

Many scammers have fumbled their plans this way sending information that doesn't even exist, I've received Trezor scam alert in email like OP but I never own Trezor wallet to begin with..

[Zlantann]

Thanks, OP, for sharing. Some people might not have access to this information if you have not shared it here.

this is a clear sign that, scammers are always working tirelessly and these scammers are most times very much informed  and that is why, everyone really needs to take their safety and security very serious because i have also come to realize no one is even above been scammed and this very phishing scam method have always been there and of recent i heard of a case where some group of scammers were caught impersonating the FBI and i was very concerned n how these people get to convince their victims and get to take money from the.

we should always try to verify every link and email we receive from official website else we might just fall victim of what we might not expect.

However, this attack is targeted, after Trezor's logistics partner, ShipMonk leaked shipping details of Trezors customers, and now the attackers actually know who has actually bought a Trezor device in the last 90 days.

The recipients of these phishing emails didn't do anything wrong to be targeted by these scammers. Their details were leaked from a third-party service provider. Trezor will ask for your details because third parties like ShipMonk will need them to send wallets to owners.

Some people become victims because of fear and poor judgment. When you receive such emails, don't panic or act out of fear. Acting calmly helps to make sound judgments.

[cryptomaniac_xxx]

We are under the attack right now, there is this online and phishing attacks, and then the physical $5 wrench attack. So right now, we are at the mercy of this criminals. It's good that Trezor might have issues this kind of warning to us.

So now it feel on everyone to be very vigilant, review the best security practices and hardened it as much as we can. Don't put your mnemonic seed in any apps that ask for it. Don't use Google to search for like Trezor or Ledger update as the Big G doesn't care. As long as this scammers are paying, they will put the ads on the first page so better watch out.

[bitbollo]

E-mails (at least here in my country) have 0 value for this kind of communication.
You need to use physical communication or just a specific electronic email. this is just the only way to stay safe against these scams.
Hardware wallets customers, unfortunately, are just a part of this campaign.
In general there is a strong increase of "sophisticated" attack, including "job proposal" or whatever linked to crypto.

[SeriouslyGiveaway]

We are under the attack right now, there is this online and phishing attacks, and then the physical $5 wrench attack. So right now, we are at the mercy of this criminals. It's good that Trezor might have issues this kind of warning to us.

So now it feel on everyone to be very vigilant, review the best security practices and hardened it as much as we can. Don't put your mnemonic seed in any apps that ask for it. Don't use Google to search for like Trezor or Ledger update as the Big G doesn't care. As long as this scammers are paying, they will put the ads on the first page so better watch out.

Recent attacks online and offline are newest examples and reminders for people about super importance of privacy and anonymity. We can not rely on anyone, any company to secure our sensitive information and documents. The best and safest way is securing these ones by ourselves, and avoid KYC as most as possible.

Use cash for payments, avoid online orders that require identity information, geo location and more.

Bitcoin privacy resources.
Why is KYC extremely dangerous and useless.
A call to action: stop the FCC KYC regime.
How to protect your Bitcoin from $5 wrench attacks.
Can duress wallets stop Bitcoin attacks.
The Bitcoiner's guide to physical security.
How to really disappear from Internet?

[New Judgement]

I never rely on notifications in my email for updates. I can receive and read emails but for important things, I will double check with the official website, social media accounts of that company to see whether what I received in emails is true before doing any further actions.

Quickly believe in anything, without double checks, and take action immediately is very risky.

But it’s truly convincing when you receive an email form the platform the platform you registered your email with. You know where you registered with your email, and there is this belief that where such email is registered with is a trusted source. Only few will be wise enough to check other social platforms to verify is it’s actually true. And I wouldn’t blame those that might not care to check because, how were emails able to leak from the platform you registered with. How did your email got end up with scammers, how did the scammers know the exact emails that had an account with Trezor? It simply means that someone who had access to their emails registered with Trevor had leaked them out scammers. Because ordinarily when you receive an email from the official account that you know you trust, you will do whatever updates they ask you to do with your account with them.

[DabsPoorVersion]

This serves as a good reminder to users that by knowing the previous security incidents also made us to be more cautious and helps to protect the users from posible fraud to come. It's the same as when the user know and understand what happened in the previous incident, they will likely to think before they click more than once when encountered something similar to the previous situation.