Pocket

On March 19, Trezor’s X suffered a <a href="https://bitcoinist.com/trezor-alerts-66000-users-to-risk-of-phishing/" target="_blank" rel="noopener ">security breach</a> that exposed the account’s 200,000 followers to a fake crypto presale. After the alarms were raised, most crypto users stayed vigilant while the hardware wallet company regained control. 
Trezor’s team recently published a preliminary report addressing the concerns. The post also explained the elaborate phishing scam that bypassed the company’s security measures. 
<h2 style="font-weight: 400;" id="is-trezor-s-unwavering-security-still-protecting-your-crypto">Is Trezor’s “Unwavering Security” Still Protecting Your Crypto?</h2> 
After gaining control of the account, the hacker <a href="https://twitter.com/zachxbt/status/1770225097552363795?ref_src=twsrc%5Etfw%7Ctwcamp%5Etweetembed%7Ctwterm%5E1770225097552363795%7Ctwgr%5Ed4397b1156b69bcb1b5b5db472759fc1be8caf10%7Ctwcon%5Es1_&amp;ref_url=https%3A%2F%2Fwww.newsbtc.com%2Fnews%2Ftrezor-x-account-hacked-how-much-was-taken-in-the-fake-crypto-presale%2F" target="_blank" rel="noopener nofollow">posted</a> a fake presale address for a $TRZR token. Disguised as an “initiative” to help the Slerf community, the post offered a “separate bonus airdrop” from a website linked in the post that redirected to a wallet drainer. 
After Trezor regained control of the account, X users expressed their worries about the incident and suggested that the hack was a “bad look” on the security-focused company. However, the company guaranteed that they had “robust security measures.” 
<blockquote>
 We want to clarify that we do not make use of SMS for 2FA, and instead employ more secure methods of authentication.
</blockquote> 
The company finally <a href="https://blog.trezor.io/update-addressing-concerns-around-our-recent-x-twitter-account-breach-a888bc349007" target="_blank" rel="noopener nofollow">addressed</a> users’ concerns in a preliminary report. The hack is possible due to a “sophisticated phishing scam” instead of a lack of basic security measures. 
The company is based on “unwavering security,” the post states; as such, all products and internal systems remain unaffected despite the breach. 
<img loading="lazy" decoding="async" class="size-large wp-image-288963 aligncenter" src="https://bitcoinist.com/wp-content/uploads/2024/03/Captura-de-Pantalla-2024-03-22-a-las-11.55.14-a.-m.png?w=980&amp;resize=980%2C225" alt="Trezor, crypto hack" width="980" height="225" srcset="https://bitcoinist.com/wp-content/uploads/2024/03/Captura-de-Pantalla-2024-03-22-a-las-11.55.14-a.-m.png?w=1004 1004w, https://bitcoinist.com/wp-content/uploads/2024/03/Captura-de-Pantalla-2024-03-22-a-las-11.55.14-a.-m.png?w=640 640w, https://bitcoinist.com/wp-content/uploads/2024/03/Captura-de-Pantalla-2024-03-22-a-las-11.55.14-a.-m.png?w=768 768w, https://bitcoinist.com/wp-content/uploads/2024/03/Captura-de-Pantalla-2024-03-22-a-las-11.55.14-a.-m.png?w=980&amp;resize=980%2C225 980w, https://bitcoinist.com/wp-content/uploads/2024/03/Captura-de-Pantalla-2024-03-22-a-las-11.55.14-a.-m.png?w=750 750w" sizes="(max-width: 980px) 100vw, 980px" data-recalc-dims="1"> 
<h2 style="font-weight: 400;" id="sophisticated-phishing-scam-steals-pocket-change">Sophisticated Phishing Scam Steals Pocket Change</h2> 
According to Trezor, the ongoing investigation has revealed that “the breach appears to have arisen from a sophisticated and calculated phishing attack that was in the works for weeks.” 
The <a href="https://bitcoinist.com/over-2-6m-stolen-in-phishing-scam-involving-top-crypto-trader/" target="_blank" rel="noopener ">calculated scheme</a> began on February 29 after the attacker posed for a “credible entity” from the crypto industry. At the time of writing, the identity of the impersonated figure was not revealed. 
The attacker contacted Trezor’s PR team through X using a “well-crafted social media presence.” The seemingly genuine contact aimed to schedule an interview with the company’s CEO. 
According to the report, the attacker and the team had a back-and-forth conversation over several days, which made the efforts to stage a call seem more credible. However, the call agreement led to the click of the link that granted access to Trezor’s X account. 
The malicious link was disguised as a Calendly invite that, upon clicking, redirected a Trezor’s team member to a page requesting the X login credentials. The team rescheduled the call as the incident raised red flags. 
During the rescheduled call, the attacker pretended to have technical issues and urged Trezor’s team member “to ‘authorize’ joining the call.” This authorization connected the hacker’s Calendly app with the company’s <a href="https://bitcoinist.com/microstrategy-x-account-hacked/" target="_blank" rel="noopener ">X account</a>. As a result, the attacker gained access to the account and published the now-deleted posts. 
<blockquote class="twitter-tweet" data-width="500" data-dnt="true"> 
 he got a whopping 0.96 Solana as well <a href="https://t.co/zqHjxM8EOI" rel="nofollow" target="_blank">pic.twitter.com/zqHjxM8EOI</a> 
 — xc (@Theft) <a href="https://twitter.com/Theft/status/1770237549547802922?ref_src=twsrc%5Etfw" rel="nofollow noopener" target="_blank">March 19, 2024</a>
</blockquote> 
The hacker only stole $8,100 from the malicious link redirecting to the wallet drainer. &nbsp;Impressively, just 0.96 SOL (around $162,4 at writing time’s pricing) were sent to the fake presale address. 
Undoubtedly, the attack was a calculated and elaborate scheme that aimed to become a big heist. However, the hacker’s attempt was halted by the crypto community surveillance and the suspicious nature of the unauthorized posts. 
<img loading="lazy" decoding="async" class="size-large wp-image-288958 aligncenter" src="https://bitcoinist.com/wp-content/uploads/2024/03/BTCUSDT_2024-03-22_11-21-07.png?w=980&amp;resize=980%2C493" alt="BTC,BTCUSDT, crypto scam, trezor" width="980" height="493" srcset="https://bitcoinist.com/wp-content/uploads/2024/03/BTCUSDT_2024-03-22_11-21-07.png?w=1022 1022w, https://bitcoinist.com/wp-content/uploads/2024/03/BTCUSDT_2024-03-22_11-21-07.png?w=640 640w, https://bitcoinist.com/wp-content/uploads/2024/03/BTCUSDT_2024-03-22_11-21-07.png?w=768 768w, https://bitcoinist.com/wp-content/uploads/2024/03/BTCUSDT_2024-03-22_11-21-07.png?w=980&amp;resize=980%2C493 980w, https://bitcoinist.com/wp-content/uploads/2024/03/BTCUSDT_2024-03-22_11-21-07.png?w=360 360w, https://bitcoinist.com/wp-content/uploads/2024/03/BTCUSDT_2024-03-22_11-21-07.png?w=750 750w" sizes="(max-width: 980px) 100vw, 980px" data-recalc-dims="1">

Is Your Crypto Safe? Trezor Addresses Concerns Over Hack, Claims “Sophisticated Phishing Scam”

Table of Contents

Bitcoinist

Other articles published on Mar 23, 2024

Crypto Prices Recover After Bad CPI Data: 5 Top Altcoins To Buy To Ride the Rally for Massive ROI

Memecoin Mania: Surging Prices Attract Investors While Risk of Loss Intensifies

Solana hits May 2022 high; Is it all good news for SOL traders?

Are Non-Custodial Crypto Wallets Really Banned In The EU?

GRT and Pyth Network’s Surge Fades Away Before BlockDAG’s Rapid Batch 3 Sellout

AMM Transforms XRP Ledger

Join our free newsletter for daily crypto updates!