Phishers Exploit Trezor’s Own Support System in Latest Crypto Scam—But It Could’ve Been Worse

In a sophisticated phishing campaign that flipped the script on traditional scam tactics, threat actors leveraged Trezor’s own customer support system to deliver fraudulent emails to unsuspecting users—mimicking legitimate replies from the hardware wallet maker itself.

The deception was revealed on Monday via a public post from Trezor’s official X (formerly Twitter) account, which warned users about emails “appearing as legitimate Trezor support replies.” The company confirmed that attackers had abused its online contact form to initiate these messages, which were auto-sent by its support infrastructure—despite no breach of Trezor’s internal systems or email databases.

No credentials were stolen from Trezor’s side, but the tactic exploited the implicit trust customers place in receiving replies from a verified source. The goal, as in many crypto phishing schemes, was to coax users into giving up sensitive wallet recovery information—a digital skeleton key for draining funds. Trezor reiterated that it “will never ask for your wallet backup,” underscoring that such details must remain “private and offline.”

The phishing attempt is a chilling reminder that even robustly secured ecosystems can be manipulated at the intersection of automation and user trust.

“Trezor remains a high-value target for attackers, not because of any inherent weakness, but because of the asymmetric risk it represents,” said Randolph Barr, Chief Information Security Officer at Cequence. “Even a single successful compromise… can lead to substantial financial gain for bad actors.”

The Playbook—and the Counterplay

The incident was quickly contained, according to Trezor, with the firm assuring customers that its contact form is still “safe and secure.” No indication has emerged that customer data was leaked beyond the affected support interaction.

Security experts say that while the misuse of automated systems isn’t novel, what stands out in this case is how quickly Trezor responded to neutralize the threat and communicate openly.

“It’s encouraging to see how swiftly their team moved to contain the issue, reinforce controls, and communicate with transparency,” Barr said. He praised the firm for having “security practices that exceed common industry benchmarks,” adding that resilience in cybersecurity often comes down to preparation, not perfection.

“Regular testing is how you develop muscle memory across teams… so when an incident occurs, you’re not scrambling—you’re executing a plan you’ve validated under pressure.”

A Familiar Battlefield

The crypto world is no stranger to phishing campaigns. In May, a single user lost $2.6 million in stablecoins across two attacks within hours. Other industry players like CoinMarketCap and Cointelegraph have also seen malicious scripts or pop-ups briefly hijack their platforms to impersonate wallet verifications or airdrop events—before rushing to patch the issues.

What makes phishing especially insidious in the digital asset space is that once a private key or seed phrase is compromised, there’s no recourse. Unlike a hacked credit card, a stolen crypto wallet has no central authority to reverse the damage.

This reality is driving a security arms race between attackers crafting more believable lures and companies working to anticipate exploits that don’t require breaking in—just slipping through gaps in user behavior and system workflows.

The Human Firewall

As digital wallets become more mainstream, users must remain the first and last line of defense. That means double-checking URLs, never entering sensitive information through links in emails, and understanding that real support teams will never ask for recovery phrases or keys—ever.

Trezor’s containment of this attack may prove to be a case study not only in handling a breach but in the critical importance of user education.

“This incident is a strong reminder of the broader principle: ‘It’s not a matter of if, but when,’” Barr concluded. “Success hinges on your ability to identify quickly, respond decisively, recover efficiently, and communicate transparently.”

It’s a mantra every company in crypto—and every user—should commit to memory.