Latest News

Executive: Trezor, a cryptocurrency wallet, investigates a phishing effort.

Trezor’s brand ambassador Josef Tetek emphasized that the hardware wallet firm never asks for users’ recovery seed, PIN or passphrase.

Cryptocurrency hardware wallet provider Trezor is investigating a recent phishing campaign, as users have reported receiving phishing emails.

The anonymous blockchain sleuth ZachXBT took to his Telegram channel on Oct. 26 to alert users to a phishing attack targeting Trezor customers.

ZachXBT referred to an X (formerly Twitter) post from the account JHDN, which alleged that Trezor may have been breached after receiving phishing emails on the email account used specifically for buying the wallet.

In a similar manner to some Trezor-related phishing attacks in the past, the phishing email invites users to download the “latest firmware update” to users’ Trezor devices in order to “fix an issue in software.” According to the poster, the malicious email was sent from the email

“Be careful this person just received a phishing email to the email address associated with their Trezor purchase,” ZachXBT wrote, adding that the social media report could point to a potential data breach for Trezor or Evri, the United Kingdom delivery company that ships Trezor devices.

ZachXBT mentioned that two other people on Reddit complained about the same Trezor phishing email today.

According to Trezor’s brand ambassador, Josef Tetek, the firm is aware of the ongoing phishing campaign and is actively looking into it.

“We continuously report fake websites, contact domain registrars, and educate and warn our customers of known risks,” Tetek said, referring to multiple articles aiming to help users deal with phishing attacks. One such article says that phishing emails often redirect to download a Trezor Suite lookalike app that will ask users to connect their wallet and enter their seed.

The seed is compromised once you enter it into the app, and your funds will then be immediately transferred to the attacker’s wallet,” the page reads.

Tetek emphasized that Trezor never asks for users’ recovery seed, PIN or passphrase, adding:

“Users should never enter their recovery seed directly into any website, or mobile app or type it into a computer. The only safe way to work with the recovery seed is as per the instructions shown on a connected Trezor hardware wallet.”

Cryptocurrency investors have been suffering from multiple phishing attacks despite many efforts to curb such scams. In September, a large crypto investor reportedly fell victim to a massive phishing campaign, losing $24 million worth of crypto assets. According to some cybersecurity reports, the number of cryptocurrency phishing attacks saw a 40% increase in 2022.

Crypto products and NFTs are unregulated and can be highly risky. There may be no regulatory recourse for any loss from such transactions. Crypto is not a legal tender and is subject to market risks. Readers are advised to seek expert advice and read offer document(s) along with related important literature on the subject carefully before making any kind of investment whatsoever. Crypto market predictions are speculative and any investment made shall be at the sole cost and risk of the readers.