The hardware wallet company is warning users after its support system was exploited for phishing attempts.
Hardware wallet manufacturer Trezor issued a security alert after malicious actors manipulated their support system to orchestrate phishing campaigns.
Attackers used Trezor’s online contact form to submit support requests using the email addresses of unsuspecting victims. This triggered automatic responses that appeared to be legitimate messages from Trezor’s support team.
“These fraudulent emails may look authentic but are phishing attempts. Never share your wallet backup — it must remain private and offline. Trezor will never ask for your wallet backup,” the company’s official X account stated.
Trezor reassured its users, confirming the situation was quickly contained. The contact form remains “safe and secure”, and no direct breach of the company’s email systems occurred. However, it’s likely that the victims’ email addresses were sourced from previous data breaches on other platforms.
“We are actively exploring ways to prevent future abuse,” Trezor announced. “Security is a continuous process. Stay vigilant.”
This isn’t the first email-based attack involving Trezor. In March 2022, a breach of newsletter provider Mailchimp led to phishing emails being sent out, prompting users to download malicious software disguised as Trezor updates.
