Scammers Exploit Trezor Email Provider Breach to Target Hundreds of Thousands of Crypto Users

Trezor, a well‑known hardware wallet manufacturer, has confirmed a second major data breach involving the email service it relies on for customer communications. The incident exposed the personal details of hundreds of thousands of email addresses linked to Trezor users, support staff, and marketing contacts. Exposed data includes names, email addresses and, in some cases, security‑question answers—information that fraudsters can weaponise to craft convincing phishing campaigns.

Cybercriminals are already leveraging the leaked list to send fake support tickets, bogus firmware‑update alerts, and even fabricated investment offers. These messages typically ask recipients to verify their wallet, enter two‑factor authentication (2FA) codes, or share private keys. The approach is especially effective against newer investors and those less familiar with technical security practices.

Trezor urges its community to remain vigilant and scrutinise any email that claims to be from the company. Official communications are sent only from the “trezor.io” domain, and the firm never requests private keys, passwords, or seed phrases via email. Enabling 2FA, using a reputable password manager, and reporting suspicious emails are among the recommended safeguards.

Security analysts caution that a breach is rarely a one‑time event. Stolen data often circulates on dark‑web marketplaces for months, fueling new attack vectors. Therefore, crypto owners should regularly review their security settings, update recovery phrases, and immediately alert Trezor if they notice unusual activity. The company also announced that it will conduct additional audits and roll out security enhancements to better protect its users moving forward.

Source: TechCrunch

ETİKETLER