Trezor users targeted in phishing scam after contact form exploit

Scammers misused Trezor’s support system to send fake emails in an attempt to steal wallet backups from users.

What happened

Trezor, a major provider of hardware wallets for cryptocurrency, has warned users about a phishing scam that exploited its website’s contact form. Attackers used the form to send emails posing as Trezor’s support team, trying to trick recipients into revealing their wallet backups, a sensitive detail that provides full access to crypto funds.

Trezor confirmed that the scam emails appeared legitimate and were carefully worded to gain users' trust. The company says that no internal systems were breached and that the exploit was limited to how emails were routed through automated contact form responses.

Going deeper

The phishing campaign involved attackers submitting fake support requests using email addresses gathered from an unspecified source. While they could manipulate subject lines to mimic official support, they never had access to Trezor’s internal infrastructure. In some cases, Trezor’s own automated systems may have inadvertently helped deliver the phishing emails.

Trezor disclosed the incident on X (formerly Twitter) and later elaborated in a statement to The Crypto Times, confirming that user funds remain safe and no data was stolen.

The company reiterated a security warning: users should never share wallet backups, as these give full access to stored cryptocurrency. Trezor stressed that it will never ask for this information under any circumstances.

What was said

“These scam emails appear legitimate but are a phishing attempt. Remember, NEVER share your wallet backup — it must always stay private and offline,” Trezor posted on X.

The company added that it is actively reviewing internal procedures to prevent future misuse of its communication tools. Users are encouraged to verify messages using Trezor’s official support channels.

The big picture

Phishing scams are designed to exploit trust cues such as official-looking email layouts and automated messaging systems. Without breaching internal networks, attackers can still use public tools to impersonate well-known brands. These tactics call for greater caution among crypto users, who must watch for subtle misuses of familiar platforms. For companies, the challenge now includes securing both technical infrastructure and outward-facing communication channels to reduce the risk of deception.

FAQs

What is a wallet backup, and why is it so sensitive?

A wallet backup typically includes a recovery seed phrase or private key that gives full access to a crypto wallet. If someone obtains it, they can transfer all the funds without needing your device or password.

How did the attackers send phishing emails through Trezor’s system?

They used Trezor’s public contact form to generate automated replies from support, which made the phishing messages appear more credible even though Trezor’s internal systems were never breached.

How can users verify if an email from Trezor is genuine?

Users should avoid clicking on suspicious links and instead visit Trezor’s official website or use their verified support channels to confirm any communication.

Has Trezor taken steps to prevent this in the future?

Yes. The company stated it is reviewing and updating internal processes to reduce the risk of abuse through public forms and automated systems.

Are hardware wallets like Trezor still safe to use?

Yes, when used correctly. The hardware itself wasn’t compromised, and the scam targeted user behavior, not the wallet’s security features.