Update to incident: Trezor warns of phishing email after email provider breach
Trezor: phishing email led to an app requesting wallet backups; about 2,500 people opened the link
Trezor has disclosed details. Brevo, the vendor's mailing platform, was breached; the incident affected 120 Brevo accounts. The email was sent to about 347,000 addresses in the newsletter database. The email link offered an app download that asked users to enter their wallet backup. Trezor blocked the domain after 20 minutes, but around 2,500 people had opened the link by then. The vendor cannot confirm whether the database was downloaded, so it considers all addresses known to the attacker. They may be used for further phishing campaigns.
If you entered your wallet backup into the app from the email or anywhere other than your Trezor device, immediately create a new wallet on the device and transfer funds to it. If you only opened the link and entered nothing, your funds are safe. The attackers most likely have your address from Trezor's mailing list: do not follow links in emails claiming to be from Trezor, and never enter your backup outside the device. Details are linked below.
Source: trezor.io
Incident history
- 09 SeptTrezor warns of phishing email after email provider breach
- 10 SeptTrezor: phishing email led to an app requesting wallet backups; about 2,500 people opened the link