Trezor User Reports New Wave of Phishing

A Trezor user has reported phishing emails containing a fake warning about a critical vulnerability in the device's firmware. The company has confirmed a new wave of attacks, noting that the attackers may be using data from various leaks. User x3ideRaven received a phishing email disguised as a message from Trezor and began receiving fraudulent messages after purchasing the device. The fake email mentioned a critical entropy vulnerability in the firmware, claiming that a bug in the 2021 update could affect the generation of seed phrases. The email indicated that vulnerable firmware versions might have used a non-cryptographic pseudorandom number generator, reducing the entropy of seed phrases from 128 to 40 bits. Trezor confirmed the new wave of phishing, stating that attackers are using data from various leaks in cryptocurrency service databases, and that some KYC data may have been compromised. The company reminded users of a previous security incident involving a third-party tool and has taken steps to prevent further leaks. Two weeks prior, Trezor reported a data breach affecting 13,689 customers due to a hack of its logistics partner ShipMonk.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.