Trezor user reports new wave of phishing

cryptonews.ruPublicado a 2026-08-26Actualizado a 2026-08-26

Resumen

A Trezor user reported receiving a phishing email disguised as a message from the hardware wallet provider. The fake email claimed there was a critical entropy vulnerability in the firmware, alleging that a 2021 update could have weakened the seed phrase generation on some devices. Trezor acknowledged this new wave of phishing attacks, stating that attackers are likely using a combination of data from past leaks at various cryptocurrency services, which may include compromised KYC information. The company referenced a prior security incident involving a third-party tool and mailing list subscriber emails as a possible link. Trezor also noted it has taken measures to prevent further data leaks. This follows a recent report from Trezor about a data breach affecting 13,689 customers due to a hack at its logistics partner, ShipMonk, approximately two weeks earlier.

X user under the pseudonym x3ideRaven reported receiving a phishing email disguised as a message from Trezor. According to him, he purchased a device the day after the company's reported data breach period, but still started receiving fraudulent messages.

The fake email claimed to be about a supposed "critical entropy vulnerability in the firmware." The attackers alleged that a bug in a 2021 update could affect seed phrase generation on some devices.

Specifically, the email claimed that due to a configuration error, vulnerable firmware versions could use a non-cryptographic pseudorandom number generator instead of a hardware true random number generator. Supposedly, this could reduce the seed phrase entropy from 128 to 40 bits.

Trezor stated that they are aware of the new wave of phishing.

"We have confirmed that attackers are using a combination of data from different database leaks at several cryptocurrency services. It is quite possible that some KYC data may have been compromised, and the attackers are now trying their luck," the company noted.

The team reminded about a previous security incident related to a third-party tool and mailing list subscriber email addresses. Company representatives suggested this case could be linked to the current phishing campaign.

Trezor also added that they have already taken measures to prevent further leaks.

Recall that approximately two weeks prior to this report, Trezor announced a leak of customer personal data due to a hack of their logistics partner ShipMonk. The incident affected 13,689 buyers.

end-content

Preguntas relacionadas

QWhat is the main topic of the article?

AThe article discusses a new wave of phishing emails targeting users of the Trezor hardware wallet, where attackers are impersonating the company to send fraudulent security alerts.

QWhat vulnerability did the phishing email claim to be warning users about?

AThe phishing email claimed to warn about a 'critical entropy vulnerability in the firmware,' specifically that a bug from a 2021 update could have affected seed phrase generation, potentially reducing entropy from 128 to 40 bits by using a non-cryptographic pseudorandom number generator.

QHow did Trezor explain the source of the phishing targets' contact information?

ATrezor stated that the attackers are likely using a combination of data from different database leaks across multiple cryptocurrency services, and that some KYC data may have been compromised.

QWhat previous security incident did Trezor mention in relation to this phishing campaign?

ATrezor mentioned a previous security incident involving a third-party tool and email addresses of newsletter subscribers, suggesting it might be related to the current phishing campaign.

QWhat other recent data breach was mentioned in the article that affected Trezor customers?

AThe article mentions that approximately two weeks prior, Trezor reported a leak of customer personal data due to a hack of its logistics partner, ShipMonk, which affected 13,689 buyers.

Lecturas Relacionadas

Avici Commits to Fully Compensate Users as Hackers Move to New Victims

Neobank Avici has committed to fully compensating users affected by an August 28th hack that drained approximately $500,859 from 1,685 user cards. The exploit, linked to a flawed Solana smart contract, allowed an attacker to withdraw funds. Following the attack, Avici's native token plummeted nearly 40%. Separately, on August 29th, the Ethereum lending protocol Ajna suffered a $775,000 loss due to a liquidation accounting exploit. This comes amid a costly year for audited protocols; a 2026 report notes over 245 crypto security incidents from January 2025 to July 2026, resulting in $3.63 billion in losses, with 88.44% stemming from attacks on audited projects.

cryptonews.ruHace 1 min(s)

Avici Commits to Fully Compensate Users as Hackers Move to New Victims

cryptonews.ruHace 1 min(s)

Sberbank prepares loans backed by cryptocurrency: Ethereum and Tether on the list

Sberbank is preparing to expand its cryptocurrency-backed loan program. Initially accepting only Bitcoin as collateral, the bank plans to later include Ethereum and the stablecoin Tether. This expansion, however, is contingent on receiving approval from the Central Bank of Russia for their public circulation. According to Anatoly Popov, Deputy Chairman of the bank's board, cryptocurrency in this scheme serves not as a payment method but as collateral for a traditional banking product. The bank emphasizes the importance of asset liquidity, transparent valuation, and regulatory status before any digital token can be used in such transactions. Sberbank, which already has practical experience with crypto instruments, aims to adapt existing products and expand its offerings once the necessary regulatory norms come into force. This model links traditional bank financing with digital assets, where the collateral provides security for the lender under standard civil law procedures. The approach is distinct from decentralized finance (DeFi) models, with regulatory permission being the key prerequisite, similar to practices in major markets like the European Union.

cryptonews.ruHace 2 min(s)

Sberbank prepares loans backed by cryptocurrency: Ethereum and Tether on the list

cryptonews.ruHace 2 min(s)

The $775,000 Ajna Exploit Reveals Risks Beyond DeFi's Price Oracles

Ajna Protocol, a non-custodial lending platform designed to operate without price oracles or governance, reportedly lost approximately $775,000 in ETH. The attacker exploited the platform's internal system for liquidations rather than manipulating external price feeds. The exploit targeted several liquidity pools, including syrupUSDC, wstETH, and WBTC. Ajna's core philosophy removes traditional oracles, relying instead on lenders and borrowers to set rates and determine loan health, with liquidation penalties for false triggers. The attacker focused on manipulating the protocol's own liquidation accounting logic. A security alert was reportedly issued over an hour before the attack but was not acted upon in time. The loss was significant relative to Ajna's Total Value Locked (TVL), which stood around $206,000 at the time. Post-attack data shows Ajna V2's TVL at approximately $449,783, with active loans at $30,198. While smaller compared to major 2026 crypto hacks, this incident highlights a key DeFi security challenge: financial loss can stem from exploiting assumptions in complex smart contract logic, not just from large-scale exchange breaches or oracle failures.

cryptonews.ruHace 4 min(s)

The $775,000 Ajna Exploit Reveals Risks Beyond DeFi's Price Oracles

cryptonews.ruHace 4 min(s)

Hong Kong's Securities and Futures Commission (SFC) adds SBCFX and related companies Star Bridge Capital to its alert list for unlicensed operations

Hong Kong's Securities and Futures Commission (SFC) has placed SBCFX and related entities, including Star Bridge Capital Group, on its alert list for unlicensed operations. This follows reports of significant trading losses tied to SBCFX during a London gold market crash in late August 2026, which reportedly wiped out the USDT-stablecoin accounts of thousands of retail investors. The SFC warning emphasizes that these entities are neither licensed nor registered to conduct regulated activities in Hong Kong, offering no SFC protections to local clients. While SBCFX cites operating licenses from Australian, South African, and Seychelles regulators, these do not permit operations in Hong Kong. The incident highlights growing regulatory challenges involving high-leverage algorithmic trading and the use of crypto deposits like USDT in OTC derivatives. The report notes that recovering such stablecoin assets can be particularly difficult, even with issuer intervention, due to the peer-to-peer nature of transactions and blockchain complexities.

cryptonews.ruHace 5 min(s)

Hong Kong's Securities and Futures Commission (SFC) adds SBCFX and related companies Star Bridge Capital to its alert list for unlicensed operations

cryptonews.ruHace 5 min(s)

Helius CEO Secured Votes in Final Moments Necessary to Reduce Inflation on Solana Network

Solana validators passed governance proposal SGP-0002, titled "Double Disinflation," by a narrow margin. The proposal reduces the network's inflation rate by accelerating the disinflation pace from -15% to -30%. In the final hours of voting, the proposal secured support from validators representing 67% of the vote (176.29 million SOL), surpassing the required threshold. Mert Mumtaz, CEO of Helius, played a pivotal role in rallying last-minute support. He had previously criticized validators for voting "no" under the "false pretense" it would preserve their staking yield, calling this logic "mathematical nonsense." However, some validators, like Everstake, opposed the change due to concerns about its pace and potential impact on smaller validators and overall network participation. After intense lobbying, including swaying major entities like Kraken to change their votes, the proposal passed "by a hair." Two other proposals were also voted on: the Solana Constitution (SGP-0001) passed comfortably, while SGP-0003, proposing a new transaction fee model with a burn percentage, was rejected.

cryptonews.ruHace 6 min(s)

Helius CEO Secured Votes in Final Moments Necessary to Reduce Inflation on Solana Network

cryptonews.ruHace 6 min(s)

Trading

Spot