Trezor Data Breach Phishing - Revision history

Azoundria at 19:32, 15 September 2023

2023-09-15T19:32:25Z

Azoundria: Another 30 minutes complete. Integrated information about MrChaBuDuo.

2023-07-19T21:00:46Z

Another 30 minutes complete. Integrated information about MrChaBuDuo.

@@ Line 104: / Line 104: @@
 |FXEmpire Article
 |FXEmpire reports that Trezor has issued a warning about a phishing attack that targeted some of its users<ref name=":8">[https://www.fxempire.com/news/article/trezor-issues-data-breach-warning-as-users-cite-phishing-attacks-957001 Trezor Issues Data Breach Warning As Users Cite Phishing Attacks - FXEmpire] (Jul 5, 2023)</ref>. Users received an email posing as Trezor, asking them to download an app from a fraudulent domain called 'trezor.us' instead of the official Trezor domain, 'trezor.io'. Trezor suspects that the compromised email addresses may belong to users who opted in for newsletters hosted on email marketing service provider Mailchimp. The company is investigating the data breach and has advised users not to click on links from unofficial sources<ref name=":8">[https://www.fxempire.com/news/article/trezor-issues-data-breach-warning-as-users-cite-phishing-attacks-957001 Trezor Issues Data Breach Warning As Users Cite Phishing Attacks - FXEmpire] (Jul 5, 2023)</ref>. The article is later reposted to Yahoo Finance<ref name="yahoofinance-7725" /> within several hours<ref>[https://web.archive.org/web/20220403230626/https://finance.yahoo.com/news/trezor-issues-data-breach-warning-160241180.html Trezor Issues Data Breach Warning As Users Cite Phishing Attacks - Yahoo Finance Archive April 3rd, 2022 5:06:26 PM MDT] (Apr 18, 2023)</ref>.
 |-
 |April 4th, 2022 10:34:10 AM MDT
@@ Line 177: / Line 185: @@
 == Total Amount Lost ==
 The total amount lost is unknown. It is not likely to be possible to determine the exact amount lost accurately. TBD - any information on what's been reported?
 == Immediate Reactions ==
@@ Line 205: / Line 218: @@
 === Users Report Phishing on Twitter ===
-<ref name="josearkanostwitter-7727" /><blockquote>"Wow, @Trezor, this is the best phishing attempt I have seen in the last few years. I am really lucky I don't have Trezor, because if I had, I would probably actually download that update."</blockquote>
+<ref name="josearkanostwitter-7727" /><ref name=":10" /><ref>[https://old.reddit.com/r/Bitcoin/comments/tvhu4n/i_fell_victim_to_the_trezor_phishing_scam/i3blv7d/ GnarWhale99 - "Just checked my spam folder and got one from noreply @trezor.US instead of .io People need to be smarter" - Reddit] (Jul 19, 2023)</ref><ref>[https://web.archive.org/web/20220404062812/https://old.reddit.com/r/Bitcoin/comments/tvhu4n/i_fell_victim_to_the_trezor_phishing_scam/i3blv7d/ GnarWhale99 - "Just checked my spam folder and got one from noreply @trezor.US instead of .io People need to be smarter" - Reddit Archive April 4th, 2022 12:28:12 AM MDT] (Jul 19, 2023)</ref><ref>[https://old.reddit.com/r/Bitcoin/comments/tvhu4n/i_fell_victim_to_the_trezor_phishing_scam/i3cw239/ <nowiki>gigahydra - "and then those [scammers] will start using browser-in-browser attacks or other techniques that are harder to detect. The fact that there are enough people who fall for low-budget phish bait actually serves to make the rest of us safer, as it makes it uneconomical to spend the time building more sophisticated lures." - Reddit</nowiki>] (Jul 19, 2023)</ref><blockquote>"Wow, @Trezor, this is the best phishing attempt I have seen in the last few years. I am really lucky I don't have Trezor, because if I had, I would probably actually download that update."</blockquote><blockquote>I got that phishing email too. It was crafted very well. It was also sent to an email address that is only associated with Trezor.</blockquote><blockquote>Just checked my spam folder and got one from noreply @trezor.US instead of .io People need to be smarter</blockquote><blockquote>and then those [scammers] will start using browser-in-browser attacks or other techniques that are harder to detect. The fact that there are enough people who fall for low-budget phish bait actually serves to make the rest of us safer, as it makes it uneconomical to spend the time building more sophisticated lures.</blockquote>
 === Users Confirming Phishing on Reddit ===
 Several other users also confirmed that they were contacted by the same phishing attempt, many on email addresses which were unique and only used for Trezor.<ref name="reddit-7721" /> TBD expand.
 === Trezor Acknowledges The Breach ===

Azoundria: Another 30 minutes complete. All open tabs integrated into the case. Prevention fully up to date.

2023-07-07T17:08:19Z

Another 30 minutes complete. All open tabs integrated into the case. Prevention fully up to date.

← Older revision		Revision as of 11:08, 7 July 2023
Line 142:		Line 142:
	A highly sophisticated phishing attack was performed against Trezor users. It leveraged recent privacy breaches which Trezor users would already be aware of, suggesting that another attack had occurred, and this time, there was some uncertainty as to whether wallet funds were safe or not. Users were instructed to download an update to their Trezor wallet software and change their PIN.		A highly sophisticated phishing attack was performed against Trezor users. It leveraged recent privacy breaches which Trezor users would already be aware of, suggesting that another attack had occurred, and this time, there was some uncertainty as to whether wallet funds were safe or not. Users were instructed to download an update to their Trezor wallet software and change their PIN.

	The email ~~falsely~~ claims that Trezor experienced a security incident and that the data of 106,856 customers has been breached<ref name=":7" />. ~~However~~, the email is not from Trezor but is a phishing attempt<ref name=":7" />. If recipients click on the link in the email, they are directed to a fake website that closely resembles Trezor's legitimate site<ref name=":7" />. ~~The~~ fake website ~~uses~~ a unicode domain phishing attack, with a subtle alteration in the URL<ref name=":7" />.		The email claims that Trezor experienced a security incident and that the data of 106,856 customers has been breached<ref name=":7" />. While the breach of contact information may be real, no funds are at risk and the email is not from Trezor but is a phishing attempt<ref name=":7" />. If recipients click on the "DOWNLOAD LATEST VERSION" link in the email, they are directed to a fake website that closely resembles Trezor's legitimate site<ref name=":7" />. Some variant of the fake website use a unicode domain phishing attack, with a subtle alteration in the URL<ref name=":7" />. <blockquote>Dear [user],

	Some phishing emails came from the trezor.us domain, which seems like a reasonable domain name that Trezor might use for US customers. The link provided in the email took users to a download page mimicking the official Trezor download page.<blockquote>"Wow, @Trezor, this is the best phishing attempt I have seen in the last few years. I am really lucky I don't have Trezor, because if I had, I would probably actually download that update."</blockquote>		We regret to inform you that Trezor has experienced a security incident involving data belonging to 106,856 of our customers, and that the wallet associated with your e-mail address [email] is within those affected by the breach.

			Namely, on Saturday, April 2nd, 2022, our security team discovered that one of the Trezor Suite administrative servers had been accessed by an unauthorized malicious actor.

			At this moment, it's technically impossible to accurately assess the scope of the data breach. Due to these circumstances, if you've recently accessed your wallet using Trezor Suite, we must assume that your cryptocurrency assets are at risk of being stolen.

			In the spirit of transparency, we wanted to make our customers aware of this incident before malicious actors could utilize this information to their detriment. We felt time was of the essence, and we are expediently working through our investigation.

			If you're receiving this e-mail, it's because you've been affected by the breach. In order to protect your assets, please download the latest version of Trezor Suite and follow the instructions to set up a new PIN for your wallet.

			Sincerely, Trezor

			DOWNLOAD LATEST VERSION

			Copyright © 2022 Trezor / SatoshiLabs s.ro., All rights reserved.

			Our mailing address is: Trezor / SatoshiLabs s.r.o. Kundratka 2359/17A Prague 8 18000 Czech Republic </blockquote>Some phishing emails came from the trezor.us domain, which seems like a reasonable domain name that Trezor might use for US customers. The link provided in the email took users to a download page mimicking the official Trezor download page. <blockquote>"Wow, @Trezor, this is the best phishing attempt I have seen in the last few years. I am really lucky I don't have Trezor, because if I had, I would probably actually download that update."</blockquote>

	=== Malware Requests Seed Phrase ===		=== Malware Requests Seed Phrase ===
Line 217:		Line 233:
	Law firm Migliaccio & Rathod LLP are reportedly investigating a potential class action against Trezor "for failing to adequately safeguard consumer information, resulting in a data breach"<ref name="classlawdc-7729" />. The breach, initially reported in March 2022, exposed the email addresses of users who had subscribed to Trezor's newsletter through MailChimp. The leaked email addresses have led to phishing scams targeting hardware wallet owners, aiming to obtain their 12-word recovery seeds and steal cryptocurrency assets. In addition to email addresses, the breach may have exposed users' phone numbers, addresses, and account passwords, which can be exploited in sophisticated attacks on recovery seeds. Users can anticipate an increase in both the number and complexity of phishing attempts, with some potentially experiencing multiple scareware attacks. If affected by the breach, Trezor users are encouraged to contact Migliaccio & Rathod LLP for assistance.		Law firm Migliaccio & Rathod LLP are reportedly investigating a potential class action against Trezor "for failing to adequately safeguard consumer information, resulting in a data breach"<ref name="classlawdc-7729" />. The breach, initially reported in March 2022, exposed the email addresses of users who had subscribed to Trezor's newsletter through MailChimp. The leaked email addresses have led to phishing scams targeting hardware wallet owners, aiming to obtain their 12-word recovery seeds and steal cryptocurrency assets. In addition to email addresses, the breach may have exposed users' phone numbers, addresses, and account passwords, which can be exploited in sophisticated attacks on recovery seeds. Users can anticipate an increase in both the number and complexity of phishing attempts, with some potentially experiencing multiple scareware attacks. If affected by the breach, Trezor users are encouraged to contact Migliaccio & Rathod LLP for assistance.
	== Individual Prevention Policies ==		== Individual Prevention Policies ==
	Trezor put together a number of tips, but the largest tip is that hardware wallet users should never ~~be entering~~ their seed phrase anywhere except on the screen of the hardware device itself. There is never any reason why a seed phrase should be entered on any other device such as a computer when using a hardware wallet.		Most companies have insecurities. Any information provided to a company may be breached or abused.

			Trezor put together a number of tips, but the largest tip is that hardware wallet users should never enter their seed phrase anywhere except on the screen of the hardware device itself. There is never any reason why a seed phrase should be entered on any other device such as a computer when using a hardware wallet.

			=== Protect Your Personal Information ===
			Obviously, anything you can do to minimize the amount of information which you provide to websites will reduce your risk.

			{{Prevention:Individuals:Protect Personal Information}}

			=== Prevent And Minimize Loss Of Funds ===
			In a typical cryptocurrency fraud, malicious actors try to use the available information to convince you to give them authorization to access or transfer funds. This can be accomplished via tricking you into providing a private key or seed phrase, signing a transaction that grants them permission to move funds, or installing malware on your device. In most cases, this will be accomplished via a greed or fear trigger, and you should be on extra guard when experiencing those emotions.

	{{Prevention:Individual:Never Share Private Keys}}		{{Prevention:Individual:Never Share Private Keys}}
Line 228:		Line 254:

	== Platform Prevention Policies ==		== Platform Prevention Policies ==
	~~There are roughly three points~~ of ~~prevention~~ and ~~mitigation in this~~ situation.		While the proper solution is to reduce the amount of information collected, a combination of improved security, increased education, and a collective industry insurance fund also provides an alternative to prevent and fully resolve a similar situation.

	~~=== Increased Education For Users ===~~
	~~{{Prevention:Platforms:Cryptocurrency Safety Quiz}}~~

	=== Inspection of ~~Trezor Third Parties~~ ===		=== Inspection of Information Storage ===
	{{Prevention:Platforms:Supply Chain Assessment}}		{{Prevention:Platforms:Supply Chain Assessment}}

	{{Prevention:Platforms:Regular Audit Procedures}}		{{Prevention:Platforms:Regular Audit Procedures}}

			=== Increased Education For Users ===
			{{Prevention:Platforms:Cryptocurrency Safety Quiz}}

	=== Industry Insurance Fund For Victims ===		=== Industry Insurance Fund For Victims ===
Line 244:		Line 270:

	== Regulatory Prevention Policies ==		== Regulatory Prevention Policies ==
	~~{{Prevention:Regulators:Placeholder}}~~		While the best solution is to reduce the amount of information collected, a combination of increased education, improved security, and a collective industry insurance fund also provides an alternative to prevent and fully resolve a similar situation.

			=== Private Identity Key Protocol ===
			{{Prevention:Regulators:Private Identity Key Protocol}}

			=== Increased Education For Cryptocurrency Users ===
	{{Prevention:Regulators:Cryptocurrency Education Mandate}}		{{Prevention:Regulators:Cryptocurrency Education Mandate}}

			=== Third Party Security Assessments ===
			{{Prevention:Regulators:Platform Security Assessments}}

			=== Establish Industry Insurance Fund ===
			{{Prevention:Platforms:Establish Industry Insurance Fund}}

	{{Prevention:Regulators:End}}		{{Prevention:Regulators:End}}

Azoundria: Another 30 minutes complete.

2023-07-05T20:11:54Z

Another 30 minutes complete.

Show changes

Azoundria: Another 30 minutes complete.

2023-07-04T21:56:47Z

Another 30 minutes complete.

Show changes

Azoundria: Another 30 minutes complete.

2023-06-28T20:03:40Z

Another 30 minutes complete.

Show changes

Azoundria: Another 30 minutes complete.

2023-06-27T16:40:07Z

Another 30 minutes complete.

← Older revision		Revision as of 10:40, 27 June 2023
Line 2:		Line 2:

	== About Trezor ==		== About Trezor ==
	<ref name="trezor-6569" /><ref name="~~trezor~~-~~6570~~" /><ref name="trezorwiki-7723" />		Trezor hardware wallet are created by SatoshiLabs<ref name="trezorwiki-7723" /> and used mainly for securely storing Bitcoin and other cryptocurrencies<ref name="trezor-6569" /><ref name=":0">[https://www.youtube.com/watch?v=wruL9LF8AUA Trezor - Initial Setup and Trezor Bitcoin Wallet Review - YouTube] (Jun 26, 2023)</ref>, though it also offers additional security features like password management and two-factor authentication<ref name="trezorwiki-7723" />. The original version, Trezor One, was released in 2014, while the newer version, Trezor Model T, came out in 2018<ref name="trezorwiki-7723" />. Both provide advanced security features to protect users' digital assets<ref name="trezor-6569" />. Storing cryptocurrency data online is considered risky due to the potential for hacking and data breaches, but Trezor hardware wallets offer offline storage, ensuring the safety of coins and reducing the risk of theft<ref name="trezor-6569" /><ref name="trezor-6570" />.

	~~"Trezor (or~~ Trezor ~~device) is~~ the ~~original~~ and ~~most trusted cryptocurrency~~ hardware ~~wallet designed and marketed by SatoshiLabs.~~" "~~The safe place for your coins~~." "~~Store your~~ coins with Trezor."		Trezor emphasizes the security and privacy benefits of their hardware wallets<ref name="trezor-6570" />. Trezor has gained trust and recognition through independent security audits, its open-source nature, and its user-friendly interface called Trezor Wallet<ref name="trezorwiki-7723" />. It supports over 1,000 coins and tokens and is compatible with various third-party wallets and services<ref name="trezorwiki-7723" />. Trezor can be purchased from their official online store or authorized resellers, and they have partnerships and developer resources available<ref name="trezorwiki-7723" />.

	"~~The primary function~~ of Trezor is to ~~serve as~~ a ~~hardware wallet for cryptocurrencies. In addition to its primary function, it has many other~~ security ~~applications~~, such as ~~password management~~ and ~~second-factor authentication." "Hardware wallet is~~ the ~~safest way to manage & trade your cryptocurrencies.~~" "~~Online exchanges and wallet providers can disappear, go offline, be hacked. They are not reliable. Go offline~~. ~~Store your coins with~~ Trezor~~. Hardware wallet is the safest way~~ to ~~manage & trade your cryptocurrencies~~."		Trezor wallets securely generate and store seed phrases offline, reducing the risk of insecure generation or online storage<ref name="trezor-6570" />. They also emphasize hands-on confirmation through features like PIN and passphrase protection, adding an extra layer of security. Trezor's open-source design promotes trust and transparency, allowing users to verify and contribute to the code<ref name="trezor-6570" />. They offer a range of security features within their Trezor Suite app, such as address signing, transaction anonymization, and support for the Tor network for anonymous communication<ref name="trezor-6570" />. Trezor values customer feedback and encourages bug reporting to ensure continuous improvement of their security products<ref name="trezor-6570" />.

	"~~The first generation of~~ Trezor, ~~first released on 29 July 2014~~, is ~~currently known~~ as Trezor ~~One~~. The ~~next~~-~~generation~~ device is ~~called~~ Trezor ~~Model T~~ and ~~was released on~~ 26 ~~February 2018~~."		The Trezor Suite app allows users to connect their wallet and manage their assets conveniently, with features such as secure trading, portfolio tracking, and easy wallet recovery<ref name="trezor-6569" />. Trezor emphasizes trust, transparency, and independence, with an open-source design and a strong foundation in privacy and security<ref name="trezor-6569" />. With over 10 years in the crypto industry, Trezor has gained the trust of over 1 million customers and is recognized as an industry innovator in hardware wallets<ref name="trezor-6569" />.

			Trezor typically comes with a hardware wallet device, a connector wire, and recovery seed booklets<ref name=":0">[https://www.youtube.com/watch?v=wruL9LF8AUA Trezor - Initial Setup and Trezor Bitcoin Wallet Review - YouTube] (Jun 26, 2023)</ref>. The recovery seed is crucial for accessing funds in case the device is lost<ref name=":0">[https://www.youtube.com/watch?v=wruL9LF8AUA Trezor - Initial Setup and Trezor Bitcoin Wallet Review - YouTube] (Jun 26, 2023)</ref>. The user would typically visit the Trezor website for the setup process, which starts with updating the firmware and confirming the device's identification number<ref name=":0">[https://www.youtube.com/watch?v=wruL9LF8AUA Trezor - Initial Setup and Trezor Bitcoin Wallet Review - YouTube] (Jun 26, 2023)</ref>. The user then sets up a PIN for accessing the wallet<ref name=":0">[https://www.youtube.com/watch?v=wruL9LF8AUA Trezor - Initial Setup and Trezor Bitcoin Wallet Review - YouTube] (Jun 26, 2023)</ref>. The PIN is entered using a number matrix displayed on the computer screen<ref name=":0">[https://www.youtube.com/watch?v=wruL9LF8AUA Trezor - Initial Setup and Trezor Bitcoin Wallet Review - YouTube] (Jun 26, 2023)</ref>.

			The recovery seed consists of 24 words that need to be written down and stored in two separate secure locations<ref name=":0">[https://www.youtube.com/watch?v=wruL9LF8AUA Trezor - Initial Setup and Trezor Bitcoin Wallet Review - YouTube] (Jun 26, 2023)</ref>. User are typically strongly advised against creating digital copies to prevent the risk of theft or loss due to hacking or accidents<ref name=":0">[https://www.youtube.com/watch?v=wruL9LF8AUA Trezor - Initial Setup and Trezor Bitcoin Wallet Review - YouTube] (Jun 26, 2023)</ref>. It is also suggested to test the wallet with a small amount of money before transferring larger amounts<ref name=":0">[https://www.youtube.com/watch?v=wruL9LF8AUA Trezor - Initial Setup and Trezor Bitcoin Wallet Review - YouTube] (Jun 26, 2023)</ref>. Even if the device is lost, the funds can be recovered using the recovery seed<ref name=":0">[https://www.youtube.com/watch?v=wruL9LF8AUA Trezor - Initial Setup and Trezor Bitcoin Wallet Review - YouTube] (Jun 26, 2023)</ref>.

	=== Notice Of Breach Received ===		=== Notice Of Breach Received ===
Line 18:		Line 22:

	"If you're receiving this e-mail, it's because you've been affected by the breach. In order to protect your assets, please download the latest version of Trezor Suite and follow the instructions to set up a new PIN for your wallet."</blockquote>		"If you're receiving this e-mail, it's because you've been affected by the breach. In order to protect your assets, please download the latest version of Trezor Suite and follow the instructions to set up a new PIN for your wallet."</blockquote>


	~~The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.~~

	Include:		Include:
Line 79:		Line 80:
	\|April 2nd, 2022 8:45:37 PM MDT		\|April 2nd, 2022 8:45:37 PM MDT
	\|Crosspost to Bitcoin Subreddit		\|Crosspost to Bitcoin Subreddit
	\|The phishing attack is crossposted to the Bitcoin subreddit<ref name="reddit-7722" />.		\|The phishing attack is crossposted to the Bitcoin subreddit<ref name="reddit-7722" />. TBD summary.
			\|-
			\|April 3rd, 2022 2:22:00 AM MDT
			\|Graham Cluley Article
			\|Graham Cluley publishes an article about the phishing attempt<ref>[https://grahamcluley.com/trezor-wallets-hacked-dont-be-duped-by-phishing-attack-email/ Trezor wallets hacked? Don’t be duped by phishing attack email - Graham Cluley] (Jun 27, 2023)</ref>. TBD more summary.
	\|-		\|-
	\|April 3rd, 2022 3:23:00 AM MDT		\|April 3rd, 2022 3:23:00 AM MDT
Line 198:		Line 203:
	<ref name="reddit-7721">[https://www.reddit.com/r/TREZOR/comments/tuwfer/trezor_phishing_scam/ Trezor Phishing Scam : TREZOR] (Apr 2, 2022)</ref>		<ref name="reddit-7721">[https://www.reddit.com/r/TREZOR/comments/tuwfer/trezor_phishing_scam/ Trezor Phishing Scam : TREZOR] (Apr 2, 2022)</ref>
	<ref name="reddit-7722">[https://www.reddit.com/r/Bitcoin/comments/tuz1v0/trezor_breach_real_or_just_a_scam_email/ Trezor breach? Real or just a scam email? : Bitcoin] (Apr 2, 2022)</ref>		<ref name="reddit-7722">[https://www.reddit.com/r/Bitcoin/comments/tuz1v0/trezor_breach_real_or_just_a_scam_email/ Trezor breach? Real or just a scam email? : Bitcoin] (Apr 2, 2022)</ref>
	<ref name="trezor-6569">https://trezor.io/ (Feb 20, 2022)</ref>		<ref name="trezor-6569">[https://trezor.io/ Trezor Homepage] (Feb 20, 2022)</ref>
	<ref name="trezor-6570">https://trezor.io/security/ (Feb 20, 2022)</ref>		<ref name="trezor-6570">[https://trezor.io/security/ Privacy & Security - Trezor Homepage] (Feb 20, 2022)</ref>
	<ref name="trezorwiki-7723">https://wiki.trezor.io/Trezor (May 21, 2022)</ref>		<ref name="trezorwiki-7723">[https://web.archive.org/web/20220409080420/https://wiki.trezor.io/Trezor Trezor - Trezor Wiki Archive April 9th, 2022 2:04:20 AM MDT] (May 21, 2022)</ref>
	<ref name="trezortwitter-7724">[https://twitter.com/Trezor/status/1510558771944333312 Trezor - "MailChimp have confirmed that their service has been compromised by an insider targeting crypto companies." - Twitter] (May 21, 2022)</ref>		<ref name="trezortwitter-7724">[https://twitter.com/Trezor/status/1510558771944333312 Trezor - "MailChimp have confirmed that their service has been compromised by an insider targeting crypto companies." - Twitter] (May 21, 2022)</ref>
	<ref name="yahoofinance-7725">[https://finance.yahoo.com/news/trezor-issues-data-breach-warning-160241180.html Trezor Issues Data Breach Warning As Users Cite Phishing Attacks - Yahoo Finance] (May 21, 2022)</ref>		<ref name="yahoofinance-7725">[https://finance.yahoo.com/news/trezor-issues-data-breach-warning-160241180.html Trezor Issues Data Breach Warning As Users Cite Phishing Attacks - Yahoo Finance] (May 21, 2022)</ref>

Azoundria: Another 30 minutes complete.

2023-06-21T17:15:46Z

Another 30 minutes complete.

Show changes

Azoundria: Initial 30 minutes sent. Down to 4 sources left.

2023-04-19T03:52:18Z

Initial 30 minutes sent. Down to 4 sources left.

← Older revision		Revision as of 21:52, 18 April 2023
Line 4:		Line 4:
	[[File:Trezor.jpg\|thumb\|Trezor]]Multiple users of the Trezor hardware wallet had their email addresses compromised, and the phishing attacker sent out a realistic, typo-free, and well planned attack complete with an altered version of the application, which requested their seed phrase. While the total value of the loss hasn't been publicized, at least one user was found who was reported to have entered the seed phrase and lost significant funds. There is no evidence that any funds will be recovered.		[[File:Trezor.jpg\|thumb\|Trezor]]Multiple users of the Trezor hardware wallet had their email addresses compromised, and the phishing attacker sent out a realistic, typo-free, and well planned attack complete with an altered version of the application, which requested their seed phrase. While the total value of the loss hasn't been publicized, at least one user was found who was reported to have entered the seed phrase and lost significant funds. There is no evidence that any funds will be recovered.

	This is a global/international case not involving a specific country.<ref name="reddit-7721" /><ref name="reddit-7722" /><ref name="trezor-6569" /><ref name="trezor-6570" /><ref name="trezorwiki-7723" /><ref name="trezortwitter-7724" /><ref name="yahoofinance-7725" /><ref name="eteq-7726" /><ref name="josearkanostwitter-7727" /><ref name="keff85twitter-7728" /><ref name="classlawdc-7729" /><ref name="watcherguru-7730" /><ref name="watchergurutwitter-7731" /><ref name="trezortwitter-8370" />		This is a global/international case not involving a specific country.<ref name="classlawdc-7729" /><ref name="watcherguru-7730" /><ref name="watchergurutwitter-7731" /><ref name="trezortwitter-8370" />

	== About Trezor ==		== About Trezor ==
			<ref name="trezor-6569" /><ref name="trezor-6570" /><ref name="trezorwiki-7723" />

	"Trezor (or Trezor device) is the original and most trusted cryptocurrency hardware wallet designed and marketed by SatoshiLabs." "The safe place for your coins." "Store your coins with Trezor."		"Trezor (or Trezor device) is the original and most trusted cryptocurrency hardware wallet designed and marketed by SatoshiLabs." "The safe place for your coins." "Store your coins with Trezor."

Line 97:		Line 99:
	\|-		\|-
	\|April 2nd, 2022 5:32:42 PM MDT		\|April 2nd, 2022 5:32:42 PM MDT
	\|~~Main Event~~		\|Phishing Posted on Reddit
	\|~~Expand this into~~ a ~~brief description~~ of ~~what happened~~ and the ~~impact~~. ~~If multiple lines~~ are ~~necessary~~, ~~add them here~~.		\|The Trezor phishing attacks are posted about on Reddit<ref name="reddit-7721" />.
			\|-
			\|April 2nd, 2022 5:36:00 PM MDT
			\|Tomáš Kafka Tweets Screenshot
			\|Twitter user Tomáš Kafka shared a screenshot of the phishing attempt he received and said he was "really lucky" he didn't have a Trezor, because if he did, he "would probably actually download that update"<ref name="keff85twitter-7728" />.
			\|-
			\|April 2nd, 2022 7:21:00 PM MDT
			\|Jose Arkos Tweets Screenshot
			\|A screenshot of the phishing email is shared by Twitter user josearkos<ref name="josearkanostwitter-7727" />.
			\|-
			\|April 2nd, 2022 8:45:37 PM MDT
			\|Crosspost to Bitcoin Subreddit
			\|The phishing attack is crossposted to the Bitcoin subreddit<ref name="reddit-7722" />.
			\|-
			\|April 3rd, 2022 4:04:00 AM MDT
			\|Trezor Confirms MailChimp Breach
			\|Trezor confirms the breach in a tweet. They state that it's been confirmed by MailChimp. They state it appears to be an insider targeting crypto companies, they've managed to take the domains down, and not to open any emails from them until further notice<ref name="trezortwitter-7724" />.
			\|-
			\|April 3rd, 2022 4:29:00 AM MDT
			\|CoinTelegraph Article
			\|CoinTelegraph posts an article covering the situation<ref>[https://web.archive.org/web/20220403103056/https://cointelegraph.com/news/trezor-investigates-potential-data-breach-as-users-cite-phishing-attacks Trezor investigates potential data breach as users cite phishing attacks - CoinTelegraph Archive April 3rd, 2022 4:30:56 AM MDT] (Apr 18, 2023)</ref>. "While Trezor attempts to identify the root cause of the situation with an official investigation, users are advised not to click on links coming from unofficial sources until further notice." <ref name="eteq-7726" /> TBD article was updated.
			\|-
			\|April 3rd, 2022 10:04:00 AM MDT
			\|FXEmpire Article
			\|FXEmpire posts an article about the phishing attack. The article is later reposted to Yahoo Finance<ref name="yahoofinance-7725" /> within several hours<ref>[https://web.archive.org/web/20220403230626/https://finance.yahoo.com/news/trezor-issues-data-breach-warning-160241180.html Trezor Issues Data Breach Warning As Users Cite Phishing Attacks - Yahoo Finance Archive April 3rd, 2022 5:06:26 PM MDT] (Apr 18, 2023)</ref>.
	\|-		\|-
	\|		\|
Line 112:		Line 138:
	== Immediate Reactions ==		== Immediate Reactions ==
	How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?		How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

			=== Users Report Phishing on Twitter ===
			<ref name="josearkanostwitter-7727" />

			=== Users Confirming Phishing on Reddit ===
			Several other users also confirmed that they were contacted by the same phishing attempt, many on email addresses which were unique and only used for Trezor.<ref name="reddit-7721" /> TBD expand.

			=== Trezor Acknowledges The Breach ===

	== Ultimate Outcome ==		== Ultimate Outcome ==
Line 141:		Line 175:

	== References ==		== References ==
	<references><ref name="reddit-7721">[https://www.reddit.com/r/TREZOR/comments/tuwfer/trezor_phishing_scam/ Trezor Phishing Scam : TREZOR] (Apr 2, 2022)</ref>		<references>
			<ref name="reddit-7721">[https://www.reddit.com/r/TREZOR/comments/tuwfer/trezor_phishing_scam/ Trezor Phishing Scam : TREZOR] (Apr 2, 2022)</ref>
	<ref name="reddit-7722">[https://www.reddit.com/r/Bitcoin/comments/tuz1v0/trezor_breach_real_or_just_a_scam_email/ Trezor breach? Real or just a scam email? : Bitcoin] (Apr 2, 2022)</ref>		<ref name="reddit-7722">[https://www.reddit.com/r/Bitcoin/comments/tuz1v0/trezor_breach_real_or_just_a_scam_email/ Trezor breach? Real or just a scam email? : Bitcoin] (Apr 2, 2022)</ref>
			<ref name="trezor-6569">https://trezor.io/ (Feb 20, 2022)</ref>
	<ref name="trezor-6569">~~[https://trezor.io/~~ https://trezor.io/] (Feb 20, 2022)</ref>		<ref name="trezor-6570">https://trezor.io/security/ (Feb 20, 2022)</ref>
			<ref name="trezorwiki-7723">https://wiki.trezor.io/Trezor (May 21, 2022)</ref>
	<ref name="trezor-6570">~~[https://trezor.io/security/~~ https://trezor.io/security/] (Feb 20, 2022)</ref>		<ref name="trezortwitter-7724">[https://twitter.com/Trezor/status/1510558771944333312 Trezor - "MailChimp have confirmed that their service has been compromised by an insider targeting crypto companies." - Twitter] (May 21, 2022)</ref>
			<ref name="yahoofinance-7725">[https://finance.yahoo.com/news/trezor-issues-data-breach-warning-160241180.html Trezor Issues Data Breach Warning As Users Cite Phishing Attacks - Yahoo Finance] (May 21, 2022)</ref>
	<ref name="trezorwiki-7723">[https://wiki.trezor.io/Trezor ~~https://wiki.trezor.io/Trezor]~~ (May 21, 2022)</ref>		<ref name="eteq-7726">[https://cointelegraph.com/news/trezor-investigates-potential-data-breach-as-users-cite-phishing-attacks Trezor investigates potential data breach as users cite phishing attacks - CoinTelegraph] (May 21, 2022)</ref>
			<ref name="josearkanostwitter-7727">[https://twitter.com/josearkanos/status/1510427249526427662 josearkanos - "Hey trezor, are you aware of a phishing campaign going on? I just received this email with my actual email on it. It looked very legit." - Twitter] (May 21, 2022)</ref>
	<ref name="trezortwitter-7724">[https://twitter.com/Trezor/status/1510558771944333312 @Trezor Twitter] (May 21, 2022)</ref>		<ref name="keff85twitter-7728">[https://twitter.com/keff85/status/1510400852716052480 Tomáš Kafka - "Wow, @Trezor, this is the best phishing attempt I have seen in the last few years. I am really lucky I don't have Trezor, because if I had, I would probably actually download that update." - Twitter] (May 21, 2022)</ref>

	<ref name="yahoofinance-7725">[https://finance.yahoo.com/news/trezor-issues-data-breach-warning-160241180.html Trezor Issues Data Breach Warning As Users Cite Phishing Attacks] (May 21, 2022)</ref>

	<ref name="eteq-7726">[https://~~eteq~~.com/trezor-investigates-potential-~~information~~-breach-as-~~customers~~-cite-phishing-~~assaults/~~ Trezor ~~Investigates Potential Information Breach As Customers Cite Phishing Assaults~~ -] (May 21, 2022)</ref>

	<ref name="josearkanostwitter-7727">[https://twitter.com/josearkanos/status/1510427249526427662 @josearkanos Twitter] (May 21, 2022)</ref>

	<ref name="keff85twitter-7728">[https://twitter.com/keff85/status/1510400852716052480 @~~keff85~~ Twitter] (May 21, 2022)</ref>

	<ref name="classlawdc-7729">[https://classlawdc.com/2022/04/05/trezor-cryptocurrency-wallet-data-breach-investigation/ Trezor Cryptocurrency Wallet Data Breach Investigation \| Migliaccio & Rathod LLP] (May 21, 2022)</ref>		<ref name="classlawdc-7729">[https://classlawdc.com/2022/04/05/trezor-cryptocurrency-wallet-data-breach-investigation/ Trezor Cryptocurrency Wallet Data Breach Investigation \| Migliaccio & Rathod LLP] (May 21, 2022)</ref>

	<ref name="watcherguru-7730">[https://watcher.guru/news/trezor-data-breach-phishing-emails Possible data breach for Trezor as users report string of phishing emails] (May 21, 2022)</ref>		<ref name="watcherguru-7730">[https://watcher.guru/news/trezor-data-breach-phishing-emails Possible data breach for Trezor as users report string of phishing emails] (May 21, 2022)</ref>

	<ref name="watchergurutwitter-7731">[https://twitter.com/WatcherGuru/status/1510576038610452480 @WatcherGuru Twitter] (May 21, 2022)</ref>		<ref name="watchergurutwitter-7731">[https://twitter.com/WatcherGuru/status/1510576038610452480 @WatcherGuru Twitter] (May 21, 2022)</ref>
			<ref name="trezortwitter-8370">[https://twitter.com/trezor/status/1510548489884815361 @trezor Twitter] (Jul 6, 2022)</ref>
	<ref name="trezortwitter-8370">[https://twitter.com/trezor/status/1510548489884815361 @trezor Twitter] (Jul 6, 2022)</ref></references>		</references>

Azoundria at 16:10, 12 April 2023

2023-04-12T16:10:12Z

← Older revision		Revision as of 10:10, 12 April 2023
Line 1:		Line 1:
	{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/trezordatabreachphishing.php}}		{{Imported Case Study 2\|source=https://www.quadrigainitiative.com/casestudy/trezordatabreachphishing.php}}
			{{Unattributed Sources}}

	[[File:Trezor.jpg\|thumb\|Trezor]]Multiple users of the Trezor hardware wallet had their email addresses compromised, and the phishing attacker sent out a realistic, typo-free, and well planned attack complete with an altered version of the application, which requested their seed phrase. While the total value of the loss hasn't been publicized, at least one user was found who was reported to have entered the seed phrase and lost significant funds. There is no evidence that any funds will be recovered.		[[File:Trezor.jpg\|thumb\|Trezor]]Multiple users of the Trezor hardware wallet had their email addresses compromised, and the phishing attacker sent out a realistic, typo-free, and well planned attack complete with an altered version of the application, which requested their seed phrase. While the total value of the loss hasn't been publicized, at least one user was found who was reported to have entered the seed phrase and lost significant funds. There is no evidence that any funds will be recovered.

	This is a global/international case not involving a specific country.		This is a global/international case not involving a specific country.<ref name="reddit-7721" /><ref name="reddit-7722" /><ref name="trezor-6569" /><ref name="trezor-6570" /><ref name="trezorwiki-7723" /><ref name="trezortwitter-7724" /><ref name="yahoofinance-7725" /><ref name="eteq-7726" /><ref name="josearkanostwitter-7727" /><ref name="keff85twitter-7728" /><ref name="classlawdc-7729" /><ref name="watcherguru-7730" /><ref name="watchergurutwitter-7731" /><ref name="trezortwitter-8370" />

	== About Trezor ==		== About Trezor ==
Line 95:		Line 96:
	!Description		!Description
	\|-		\|-
	\|April 2nd, 2022 5:32:42 PM		\|April 2nd, 2022 5:32:42 PM MDT
	\|Main Event		\|Main Event
	\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.		\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.
Line 122:		Line 123:
	== Ongoing Developments ==		== Ongoing Developments ==
	What parts of this case are still remaining to be concluded?		What parts of this case are still remaining to be concluded?
			== General Prevention Policies ==
			Trezor put together a number of tips, but the largest tip is that hardware wallet users should never be entering their seed phrase anywhere except as instructed on the screen of the hardware device itself.
			== Individual Prevention Policies ==
			{{Prevention:Individuals:Placeholder}}

			{{Prevention:Individuals:End}}

	== Prevention Policies ==		== Platform Prevention Policies ==
	Trezor put together a number of tips, but the largest tip is that hardware wallet users should never be entering their seed phrase anywhere except as instructed on the screen of the hardware device itself.		{{Prevention:Platforms:Placeholder}}

			{{Prevention:Platforms:End}}

			== Regulatory Prevention Policies ==
			{{Prevention:Regulators:Placeholder}}

			{{Prevention:Regulators:End}}

	== References ==		== References ==
	[https://www.reddit.com/r/TREZOR/comments/tuwfer/trezor_phishing_scam/ Trezor Phishing Scam : TREZOR] (Apr 2)		<references><ref name="reddit-7721">[https://www.reddit.com/r/TREZOR/comments/tuwfer/trezor_phishing_scam/ Trezor Phishing Scam : TREZOR] (Apr 2, 2022)</ref>

	[https://www.reddit.com/r/Bitcoin/comments/tuz1v0/trezor_breach_real_or_just_a_scam_email/ Trezor breach? Real or just a scam email? : Bitcoin] (Apr 2)		<ref name="reddit-7722">[https://www.reddit.com/r/Bitcoin/comments/tuz1v0/trezor_breach_real_or_just_a_scam_email/ Trezor breach? Real or just a scam email? : Bitcoin] (Apr 2, 2022)</ref>

	[https://trezor.io/ https://trezor.io/] (Feb 20)		<ref name="trezor-6569">[https://trezor.io/ https://trezor.io/] (Feb 20, 2022)</ref>

	[https://trezor.io/security/ https://trezor.io/security/] (Feb 20)		<ref name="trezor-6570">[https://trezor.io/security/ https://trezor.io/security/] (Feb 20, 2022)</ref>

	[https://wiki.trezor.io/Trezor https://wiki.trezor.io/Trezor] (May 21)		<ref name="trezorwiki-7723">[https://wiki.trezor.io/Trezor https://wiki.trezor.io/Trezor] (May 21, 2022)</ref>

	[https://twitter.com/Trezor/status/1510558771944333312 @Trezor Twitter] (May 21)		<ref name="trezortwitter-7724">[https://twitter.com/Trezor/status/1510558771944333312 @Trezor Twitter] (May 21, 2022)</ref>

	[https://finance.yahoo.com/news/trezor-issues-data-breach-warning-160241180.html Trezor Issues Data Breach Warning As Users Cite Phishing Attacks] (May 21)		<ref name="yahoofinance-7725">[https://finance.yahoo.com/news/trezor-issues-data-breach-warning-160241180.html Trezor Issues Data Breach Warning As Users Cite Phishing Attacks] (May 21, 2022)</ref>

	[https://eteq.com/trezor-investigates-potential-information-breach-as-customers-cite-phishing-assaults/ Trezor Investigates Potential Information Breach As Customers Cite Phishing Assaults -] (May 21)		<ref name="eteq-7726">[https://eteq.com/trezor-investigates-potential-information-breach-as-customers-cite-phishing-assaults/ Trezor Investigates Potential Information Breach As Customers Cite Phishing Assaults -] (May 21, 2022)</ref>

	[https://twitter.com/josearkanos/status/1510427249526427662 @josearkanos Twitter] (May 21)		<ref name="josearkanostwitter-7727">[https://twitter.com/josearkanos/status/1510427249526427662 @josearkanos Twitter] (May 21, 2022)</ref>

	[https://twitter.com/keff85/status/1510400852716052480 @keff85 Twitter] (May 21)		<ref name="keff85twitter-7728">[https://twitter.com/keff85/status/1510400852716052480 @keff85 Twitter] (May 21, 2022)</ref>

	[https://classlawdc.com/2022/04/05/trezor-cryptocurrency-wallet-data-breach-investigation/ Trezor Cryptocurrency Wallet Data Breach Investigation \| Migliaccio & Rathod LLP] (May 21)		<ref name="classlawdc-7729">[https://classlawdc.com/2022/04/05/trezor-cryptocurrency-wallet-data-breach-investigation/ Trezor Cryptocurrency Wallet Data Breach Investigation \| Migliaccio & Rathod LLP] (May 21, 2022)</ref>

	[https://watcher.guru/news/trezor-data-breach-phishing-emails Possible data breach for Trezor as users report string of phishing emails] (May 21)		<ref name="watcherguru-7730">[https://watcher.guru/news/trezor-data-breach-phishing-emails Possible data breach for Trezor as users report string of phishing emails] (May 21, 2022)</ref>

	[https://twitter.com/WatcherGuru/status/1510576038610452480 @WatcherGuru Twitter] (May 21)		<ref name="watchergurutwitter-7731">[https://twitter.com/WatcherGuru/status/1510576038610452480 @WatcherGuru Twitter] (May 21, 2022)</ref>

	[https://twitter.com/trezor/status/1510548489884815361 @trezor Twitter] (Jul 6)		<ref name="trezortwitter-8370">[https://twitter.com/trezor/status/1510548489884815361 @trezor Twitter] (Jul 6, 2022)</ref></references>