Trezor third-party email provider breached

[PX-Z]

At this time around idk if people will still call or consider trezor as safe hardware wallet. These hack incidents for the past few weeks are increasingly difficult to overlook, particularly when they involve the handling and protection of user information. Pople will just remember how irresponsible they are. What a disappointment.

[philipma1957]

I have had to place my trezor in a bank safety deposit box


Along with a seed.

And then put the passphrase in another storage spot.

I get emails and letters.

So if I get the wrench attack I hope this saves me.

[Pmalek]

At this time around idk if people will still call or consider trezor as safe hardware wallet. These hack incidents for the past few weeks are increasingly difficult to overlook, particularly when they involve the handling and protection of user information. Pople will just remember how irresponsible they are. What a disappointment.

User data leaks and activities that affect your privacy should not be compared to security incidents. These recent data leaks have not decreased the security of your coins or impacted seed generation and the handling of private keys. That is done locally, in your device and at the place of your choosing. If in the future something does happen that affects the security of Trezor devices, that will be a completely different story.

I have had to place my trezor in a bank safety deposit box


Along with a seed.

And then put the passphrase in another storage spot.

I get emails and letters.

So if I get the wrench attack I hope this saves me.

Or it makes the thief even angrier and more aggressive if he thinks you are lying to him and you don't want to cooperate to protect your money.

[greysonz]

Today, Trezor clarified the scale of the hack, and it turned out to involve nearly 150,000 addresses that received phishing emails. About 2,500 people managed to click on the malicious link. I think it’s hard to blame these 2,500 people for being careless, because these are such turbulent times - when hardware wallets are patching their vulnerabilities and you need to react quickly, or when this kind of phishing is happening, and users want to protect their bitcoins, so they quickly click on the link, especially when they see a good email address from the sender.

[salad daging]

Today, Trezor clarified the scale of the hack, and it turned out to involve nearly 150,000 addresses that received phishing emails. About 2,500 people managed to click on the malicious link. I think it’s hard to blame these 2,500 people for being careless, because these are such turbulent times - when hardware wallets are patching their vulnerabilities and you need to react quickly, or when this kind of phishing is happening, and users want to protect their bitcoins, so they quickly click on the link, especially when they see a good email address from the sender.

There have been no reports of 2500 who managed to click on the malicious link to lose their coins, until now have not found News on X or on Reddit, it seems the case of losing coins due to phishing is little or no.

At this time around idk if people will still call or consider trezor as safe hardware wallet. These hack incidents for the past few weeks are increasingly difficult to overlook, particularly when they involve the handling and protection of user information. Pople will just remember how irresponsible they are. What a disappointment.

I am a Trezor user until now it is still safe to use this device, Trezor itself has confirmed the device remains safe unaffected.
The data leak came from a third party, while we can be vigilant we will not lead to phishing.

[AakZaki]

At this time around idk if people will still call or consider trezor as safe hardware wallet. These hack incidents for the past few weeks are increasingly difficult to overlook, particularly when they involve the handling and protection of user information. Pople will just remember how irresponsible they are. What a disappointment.

Yes, Trezor is currently safe. I'm also a Trezor user, all my BTC is still in the wallet.
This incident is just an attempt by the bastard hacker who knows a lot of emails and then tries to send a phishing link to many people, including those who don't have a Trezor wallet.

So don't make the narrative as if this is purely Trezor's fault.

What needs to be noted at this time, do not enter the seed just because of the link in the email. everyone, especially Trezor users, if they want to verify their assets, at least do it in their Trezor Suite.

[Pmalek]

Today, Trezor clarified the scale of the hack, and it turned out to involve nearly 150,000 addresses that received phishing emails. About 2,500 people managed to click on the malicious link. I think it’s hard to blame these 2,500 people for being careless, because these are such turbulent times - when hardware wallets are patching their vulnerabilities and you need to react quickly, or when this kind of phishing is happening, and users want to protect their bitcoins, so they quickly click on the link, especially when they see a good email address from the sender.

The report you linked to mentions that approximately 347,000 email addresses were affected, not 150,000 as you wrote. Clicking on the link itself is not dangerous and is not what can cause a loss of funds. Entering your recovery phrase and sending it to scammers is what can have dire consequences. Harsh as it may sound, but anyone who did that is to be blamed for whatever happens afterwards. It's not 2009. We are not in bitcoin's first years of existence. Anyone involved in this technology should know by now that you never enter such information anywhere online. That rule will not and should not change!

[m2017]

I have had to place my trezor in a bank safety deposit box

A bank safety deposit box can solve the issue of inheritance. Heirs can simply come and collect the contents (provided, of course, that they have been informed of the box's existence) once the owner no longer has any use for those assets.

However, there is a problem: a bank employee could potentially access the box.

Along with a seed.

What is the point of keeping the seed-phrase and the hardware wallet in the same place? Don't need the hardware wallet where the seed is kept (an empty HW device can simply be stored at home), and keeping the seed together with the hardware wallet defeats the purpose of having the device in the first place.

I believe it makes more sense to split the seed-phrase and store the parts in separate locations (ideally, in different banks).

And then put the passphrase in another storage spot.

You can even keep it at home. On its own, this phrase is useless and poses no threat, even if compromised.
 

I get emails and letters.

For this, it is best to use a dedicated PC \ OS (or a virtual OS), ensuring that no malicious software poses a threat. Of course, this won't protect against the most foolish mistake of all: handing over seed-phrase at the request of scammers.

So if I get the wrench attack I hope this saves me.

This will almost certainly save your crypto assets. But will it save your health and life (as well as those of your loved ones)? That remains an open question.

This was shared by Trezor a couple of minutes ago:

Our third-party e-mail provider has been breached. Please be aware that the email named ‘Critical Security Alert: STM32 Entropy Vulnerability’ is not coming from us, and it’s a phishing attempt. Do not click on any link.

We have taken down the domain, and we are investigating the situation, including how the hackers got access to our legit domain.

https://x.com/Trezor/status/2097786518110609620

As if the shipping provider leak was not enough... We've now got this. Be careful out there.

People online are saying that 2,500 users managed to click that link. The question is: how many of them managed to hand over their seed-phrases?