Hardware wallet provider Trezor has issued an urgent warning to users about an active phishing campaign exploiting its public contact form. Attackers are submitting fake support requests to trigger automated email replies containing malicious links or attachments. These emails are being crafted to mimic legitimate customer support communications, with the specific goal of tricking users into revealing their wallet backup details.
Although no breach has occurred in the company’s email infrastructure, security experts caution that such phishing attacks can be highly effective. Trezor emphasized that it will never request wallet recovery phrases, private keys, or backup data via email. It urged users to treat all unexpected communications with caution and to rely only on official company announcements and educational channels.
Victims have reportedly received emails that closely imitate standard support templates, prompting them to divulge sensitive data. Trezor has already patched the issue and urged users to be skeptical of email requests, even if they appear to come from familiar systems. Security researchers emphasize that true wallet security begins with offline backups and verified hardware. Password managers and two factor authentication offer additional protection. Trezor said the incident underlines a growing threat from phishing campaigns targeting crypto users, especially as wallet usage becomes more widespread.
