A new active phishing attack attempts to steal Trezor users’ cryptocurrency by tricking investors into entering a recovery phrase on a fake Trezor website.
Hardware cryptocurrency wallet provider Trezor has warned its users about a new phishing attack that targets their crypto investments by attempting to steal their private keys.
Trezor took to Twitter on Feb. 28 to warn users about an active phishing attack that aims to steal investors’ funds by getting them to enter their wallet’s seed phrase on a fake Trezor website.
The phishing campaign involves attackers impersonating Trezor and contacting victims via phone, text, or email, claiming there has been a security breach or suspicious activity on their Trezor account.
“Trezor Suite recently suffered a security breach, assume all of your assets are vulnerable,” the fake message reads, inviting users to click on a phishing link to “secure” their Trezor device.
“Please ignore these messages as they are not from Trezor,” Trezor declared on Twitter, stressing that the company will never contact its customers via phone or text messages. The company added that Trezor has not found any evidence of a database breach.
The latest phishing attack targeting Trezor customers was launched on February 27, with users being directed to a domain asking for their recovery seed. The domain served up a perfectly crafted fake Trezor website, prompting users to start securing their wallets by clicking a “Get Started” button.
After clicking the “Start” button, users will be asked to provide a recovery phrase for their cryptocurrency wallet.
The recovery phrase or private key of your wallet is the most important part of self-custody, keeping your cryptocurrencies in a software or hardware non-custodial wallet. The security of the recovery phrase is more important than keeping your hardware wallet safe. Once the private key is stolen, it means that the crypto assets no longer belong to their original owner.
Related: Notorious Monkey Drainer Crypto Scammers Say They’re ‘Shutting Down’
The news comes shortly after metaverse company The Sandbox suffered a data breach on February 26, resulting in a phishing email being sent to users.
The latest phishing attack targeting Trezor customers is not the first such scam. In April 2022, the Trezor wallet was also targeted by a phishing attack, where attackers contacted Trezor users posing as the company and asked them to download a fake Trezor app.
Such attacks are not unique to Trezor, though. In 2020, rival hardware wallet company Ledger suffered a massive data breach, with attackers publicly exposing the personal information of more than 270,000 Ledger customers.