Listen to the episode
TLDR
Hardware wallet maker Trezor has warned customers that attackers who compromised a third party email provider are now sending phishing emails impersonating the company. The goal is to steal wallet recovery seeds, which would give criminals...
How it works
Hardware wallet maker Trezor has warned customers that attackers who compromised a third party email provider are now sending phishing emails impersonating the company. The goal is to steal wallet recovery seeds, which would give criminals...
Red flags
- : Unsolicited emails asking you to enter or re enter your 12/24 word recovery seed Links redirecting to look alike domains that are not trezor.io Urgent language pressuring you to "verify wallet" or "restore access" immediately ✅ What to do: Never type your recovery seed into any website, form, or app Verify any Trezor communication directly via the official trezor.io site (typed manually) Forward suspicious emails to Trezor support, then delete them, and rotate credentials if you clicked a link
What to do
- 1Messages appear to come from official looking Trezor addresses and often reference fake firmware updates, security verifications, or wallet restorations.
- 2🚩 Red flags: Unsolicited emails asking you to enter or re enter your 12/24 word recovery seed Links redirecting to look alike domains that are not trezor.io Urgent language pressuring you to "verify wallet" or "restore access" immediately ✅ What to do: Never type your recovery seed into any website, form, or app Verify any Trezor communication directly via the official trezor.io site (typed manually) Forward suspicious emails to Trezor support, then delete them, and rotate credentials if you clicked a link
Source
bleepingcomputer
Source reviewed by Mythos Forensic Team
https://www.bleepingcomputer.com/news/security/trezor-warns-users-of-email-provider-breach-phishing-attacks/FAQ
Is Trezor users targeted by phishing emails after third party email provider breach a real scam pattern?
Yes. Treat the message, call, or payment request as suspicious until you verify it through an official channel.
What are the first warning signs?
: Unsolicited emails asking you to enter or re enter your 12/24 word recovery seed Links redirecting to look alike domains that are not trezor.io Urgent language pressuring you to "verify wallet" or "restore access" immediately ✅ What to do: Never type your recovery seed into any website, form, or app Verify any Trezor communication directly via the official trezor.io site (typed manually) Forward suspicious emails to Trezor support, then delete them, and rotate credentials if you clicked a link
What should I do first?
Messages appear to come from official looking Trezor addresses and often reference fake firmware updates, security verifications, or wallet restorations.; 🚩 Red flags: Unsolicited emails asking you to enter or re enter your 12/24 word recovery seed Links redirecting to look alike domains that are not trezor.io Urgent language pressuring you to "verify wallet" or "restore access" immediately ✅ What to do: Never type your recovery seed into any website, form, or app Verify any Trezor communication directly via the official trezor.io site (typed manually) Forward suspicious emails to Trezor support, then delete them, and rotate credentials if you clicked a link
Can LegalAudit check my case?
Yes. Start a free chat and paste the message, link, sender, or payment details for triage.