Trezor third-party email provider breached

[OmegaStarScream]

This was shared by Trezor a couple of minutes ago:

Our third-party e-mail provider has been breached. Please be aware that the email named ‘Critical Security Alert: STM32 Entropy Vulnerability’ is not coming from us, and it’s a phishing attempt. Do not click on any link.

We have taken down the domain, and we are investigating the situation, including how the hackers got access to our legit domain.

https://x.com/Trezor/status/2097786518110609620

As if the shipping provider leak was not enough... We've now got this. Be careful out there.

[Cookdata]

This is what the email message looks like, the phishing emails have already been sent by the scammers, hopely people don't fall for it.

[rdluffy]

WTF Trezor 

Since the ColdCard hack, I’ve already seen three Trezor announcements on X

1 - one about a data breach involving several global customers
2 - one about a breach involving U.S. customers as well
3 - and now this one about an email leak

Three times I’ve almost had a heart attack thinking it was an even worse hack 

[Charles-Tim]

This is what the email message looks like, the phishing emails have already been sent by the scammers, hopely people don't fall for it.

Trezor phishing messages supposed not to be new to Trezor users, but there will be new users that have not gotten the email before. One thing that I know is that Trezor has always been careless about the email of their customers. The home addresses of their customers and other information that were leaked recently is the new one, but this email of a thing is common and I hope Trevor has send email to their customers about it.

[Coiner.de]

One thing that I know is that Trezor has always been careless about the email of their customers. The home addresses of their customers and other information that were leaked recently is the new one, but this email of a thing is common and I hope Trevor has send email to their customers about it.

Yeah, I was wondering about the careless part as I got the email for an older email address too.
The scammer was careless too as I couldn't unsubscribe due to a "no common algorithm" error. That might have prevented some to get to the scamming page.

Interesting. I hope for a good explanation of the domain takeover. It looked so legit.

[Charles-Tim]

Interesting. I hope for a good explanation of the domain takeover. It looked so legit.

According to what OmegaStarScream quoted in his post above, no take over of the domain, it was taken down. This is common when a scam site is known and reported. If sites like Trezor report the domain, that they (Trezor) are not the owner or not linked to them in any way, it can be taken down as fast as possible. Domain take over is common to hackers when they compromise a legit site to do malicious things. And maybe it can be used when government seize a domain.

[BitMaxz]

WTF Trezor 

Since the ColdCard hack, I’ve already seen three Trezor announcements on X

1 - one about a data breach involving several global customers
2 - one about a breach involving U.S. customers as well
3 - and now this one about an email leak

Three times I’ve almost had a heart attack thinking it was an even worse hack 

This is, I think, just for privacy concerns since the breach is only for buyers' emails from the Trezor site database, not the device itself.

You can just ignore those emails if someone emails you related to seed, even if it was from a legit company or where you bought it, since they always remind us they never ask for the seed phrase.

The weak security here is their website database, not the device itself. Only those people who don't know that Trezor never asks for a seed phrase will fall into this trap.

[examplens]

I don't know if the team at Trezor is doing anything to solve this problem, but I get this same phishing email every hour.
Obviously, whoever has access to their mail server still has it and is quite persistent in sending phishing emails.
I have to admit that this seems a bit embarrassing for the Treasury. All the external companies they chose for cooperation made a mistake in some way.

[Zaguru12]

I have to admit that this seems a bit embarrassing for the Treasury. All the external companies they chose for cooperation made a mistake in some way.

Very embarrassing. Trezor team was definitely amongst us who warned ledger users of vulnerabilities like this and now Trezor has to be in mix for all of this.

Someone even had to ask on their X if there social media account isn’t also hacked too.

Hopefully users see this warning early before they fall for this phishing scam. But i definitely doubt they wouldn’t be a victim.

[X-ray]

What a rough year for hardware wallets, every month we're seeing new incident from reputable hardware wallets it's almost unbelievable.

Email is also such an easy place for hacker to forge an email and phishing people, sometime I think we should retire email or at the very least have signed message.

Last time I clicked links on email was like what? few years ago. I don't click any link beside a confirmation email that only I would expect.

Even though if we're being real, any user could prevent themselves from getting phished by knowing that no legitimate company is going to ask for your seed phrase.

[Dave1]

I have to admit that this seems a bit embarrassing for the Treasury. All the external companies they chose for cooperation made a mistake in some way.

Very embarrassing. Trezor team was definitely amongst us who warned ledger users of vulnerabilities like this and now Trezor has to be in mix for all of this.

Someone even had to ask on their X if there social media account isn’t also hacked too.

Hopefully users see this warning early before they fall for this phishing scam. But i definitely doubt they wouldn’t be a victim.

To be fair with them, technically, it was not Trezor, but their a party who handles their order thru email, Brevo, formerly Sendinblue.



https://data.trezor.io/legal/privacy-policy.html

But the thing is, it is the same company that has been breached in 2024 sending the same phishing email. And yet they didn't do anything and didn't replace that company and so  the same data breach has happened. It's going to be a cycle of Trezor won't get another 3rd party that might have a hardened security than Brevo.



https://forum.trezor.io/t/phishing-email-from-trezor-io/15309/11

[Pmalek]

Can't we get through one week without learning of a new hack or leak of customer data? It's the Wild West out there. It's not a question of if a company will get hacked but when will it happen and how serious it will be. I saw that e-mail in the spam folder of one of my email addresses last night. I didn't pay attention to what it said. I just deleted it without knowing that a leak had happened. The way things are going it's better to consider everything you receive from crypto brands as fake or scam until it's proven otherwise.

It's clear that whoever is sending those phishing emails is using the Coldcard fiasco to try to scare potential victims into believing that they might own a device that has generated a seed without the needed amount of entropy. The warning that you should never enter your seed online or share it with anyone is a nice touch. However, the next thing they ask is probably exactly that. You need to enter your seed so that they can check if it's secure enough. I am pretty sure "the check" would show that your seed is secure because the scammers want to prevent people from moving their coins from the wallets whose seeds they just received.

[salad daging]

I got the phishing email attack, because it looks legitimate to send by email <help@trezor.io>, after a few hours later the email came again a warning from Trezor itself about an unauthorized email warning.
The more terrible now hacking attacks continue to abound, I think we ourselves do not rush always verify not only from email but on his official social media as well.
This warning has been displayed in the Trezor Suite application.




It turns out that BitBox also experienced a similar incident.



- https://x.com/BitBoxSwiss/status/2097793026336981079

[FinneysTrueVision]

BitBox was also affected by the breach because they were using the same email provider and their newsletter subscribers received similar phishing emails. At this point we can no longer trust emails coming from the official domain of wallet providers.

If there is an actual vulnerability we will have to verify through multiple official communication channels before downloading anything that might be malware or inputting sensitive information on a website. It is not just seed phrases they are asking for, but also wallet XPUBs so they can do targeted attacks on wealthy individuals.

[NotATether]

They're just sending emails to anyone connected with Bitcoin now, not just to Trezor customers. The fuckers sent me one too, to an email address at notatether.com, despite me never owning a Trezor or creating an account there.

It looks like they're simply trying to phish as many people as they possibly can.

[examplens]

Very embarrassing. Trezor team was definitely amongst us who warned ledger users of vulnerabilities like this and now Trezor has to be in mix for all of this.

Someone even had to ask on their X if there social media account isn’t also hacked too.

Hopefully users see this warning early before they fall for this phishing scam. But i definitely doubt they wouldn’t be a victim.

To be fair with them, technically, it was not Trezor, but their a party who handles their order thru email, Brevo, formerly Sendinblue.

Some time ago, their users' data was leaked to a third-party partner in charge of product delivery.
I've been receiving spam with Trezor phishing emails for years...
Too many bad decisions when choosing external partners to work with. What's next from there?

[DaveF]

BitBox was also affected by the breach because they were using the same email provider and their newsletter subscribers received similar phishing emails. At this point we can no longer trust emails coming from the official domain of wallet providers.

If there is an actual vulnerability we will have to verify through multiple official communication channels before downloading anything that might be malware or inputting sensitive information on a website. It is not just seed phrases they are asking for, but also wallet XPUBs so they can do targeted attacks on wealthy individuals.

Not quite true:

You should never trust *any* email coming from *anybody* when it concerns anything important. [Or phone calls, or paper mail]

It's impossible to know who's phone got compromised. What employee with what access got phished. Which server they had onsite that had an unpatched vulnerability. And the ever popular smash and grab robbery for some of their equipment. Not to mention things that domain hijacking and good old fashion rogue employees.

It's just about verifying things.

-Dave

[Mitchell]

Brevo made a very lackluster post: https://x.com/brevo_official/status/2098013044227915777

Curious about their full post mortem later today.

[Pmalek]

BitBox was also affected by the breach because they were using the same email provider and their newsletter subscribers received similar phishing emails. At this point we can no longer trust emails coming from the official domain of wallet providers.

Regardless of it there is a vulnerability or not, you must never enter your seeds or passphrases anywhere online. There is a reason each hardware wallet company keeps repeating this crucial point. They will never ask for your seed. It doesn't matter what they say is the reason why they need your seed, you are not supposed to give it to them. Once users understand that, newbies or pros, they can then calmly research what has happened and what to do next.

[Upgrade00]

Curious about their full post mortem later today.

Their full post mortem is out; https://x.com/brevo_official/status/2098113985685971432

Looks to be a flaw in their system allowing someone with access to one company account to get into multiple others if visitors from those accounts accepted their invitation. They failed to clarify that this is explicitly their fault and did not use any apologetic term all through.