Developers of cryptocurrency wallet Trezor have confirmed that some users have suffered from a phishing attack. In the company’s blog it say that the culprits have seized users private keys but that the issue was only revealed after complaints were filed in.
“Late night yesterday, our Support Team started receiving inquiries about an invalid SSL certificate, which serves as a stamp of authenticity of our web services. Unfortunately, after investigating these reports closer, we found out that the invalid certificate warning appeared because of phishing attempts against Trezor users.”
Why it is important
- According to Satoshi Labs, hackers managed to intercept traffic of the official server. Therefore, some users that tried to access the website, were redirected to a fake one. The phishing portal asked users to undergo a seed check to ‘restore’ access. 1. Since the start of 2018, hackers have managed to steal over $1 billion in cryptocurrencies. In 27% of cases the crypto exchanges are were affected and in 21% of cases private firms. Although wallets are considered to be secure, they too may be broken into.
It is still unclear how much was stolen if anything at all. The copycat website has since been blocked by the hosting company. In their message to users, Trezor has outlined how users can avoid being scammed: “You should never enter your recovery seed anywhere but on your Trezor device. Under no circumstances should you enter your seed on a computer.” The post also suggests checking the URL of the website for the green ‘secure’ sign.
“You should only trust the device display and what is written on it. For other sources of information, always maintain a healthy amount of skepticism. This includes us at SatoshiLabs. We will never ask you for your recovery seed. Trezor Wallet will never ask you for your recovery seed. Only your Trezor device may, but it will do so securely.”
It’s also worth noting that in late June, Satoshi Labs has pushed an upgrade for various version of Trezor wallets.