Attackers abuse Trezor's support contact form to send phishing emails
Who is affected
Trezor customers and other recipients received phishing emails sent through Trezor's own support system, which made them look genuine. Trezor states its systems and user data were not accessed and the issue was contained.
What happened
On 23 June 2025 Trezor warned on X that attackers had abused its contact form to send scam emails that appeared to be legitimate Trezor support replies. According to a Trezor spokesperson quoted by Cointelegraph and The Block, the attackers submitted fake support requests on behalf of the recipients’ email addresses, which triggered automated replies from Trezor’s real support system, and were able to manipulate the subject line of those messages.
Trezor states that the attackers did not gain access to any Trezor systems, internal infrastructure or user data, that it found no evidence of a breach on its side, and that it does not know where the list of targeted addresses came from; The Block reports the addresses were likely taken from earlier crypto data breaches. The spokesperson added that the phishing website linked to the campaign had been taken down and an internal investigation launched.
Trezor said the issue was contained and the contact form remained safe to use. Neither outlet reports how many people received the emails.
What Trezor advises:
- Never share your wallet backup; it must stay private and offline.
- Trezor will never ask for your wallet backup.
Cryptocurrency is a digital or virtual currency secured by cryptography, operating on decentralized blockchain networks to enable secure, peer-to-peer transactions.
A backup in cryptocurrency is a secure copy of a wallet's seed phrase or private keys. It enables recovery of funds if the original wallet is lost or damaged.
Read full definitionSources
Independent reporting and research this entry was checked against.
Learn more
Guides on protecting yourself against this type of incident (Vendor infrastructure compromise) and the glossary terms that describe it.
How to Avoid Phishing Attacks
Phishing is the #1 way people lose crypto. Learn to spot fake emails, websites, and apps before they steal your funds.
Read GuidePhishing Defense: Protecting Your Hardware Wallet from Social Engineering
Fake websites, spoofed emails, malicious dApps — how phishing attacks target hardware wallet users and how to spot them every time.
Read GuidePhishing Attack
A phishing attack tricks crypto users into revealing private keys, seed phrases, or login details via fake emails, websites, or messages mimicking legitimate wallets or exchanges.
Malware
Malware is malicious software that steals or redirects crypto, for example by logging keystrokes, swapping copied addresses or reading wallet files.
Cite this entry
WalletInsights. “Attackers abuse Trezor's support contact form to send phishing emails”. Hardware wallet security incident tracker. Last verified November 4, 2026. https://walletinsights.io/en/security-incidents/trezor-contact-form-phishing-emails-2025/
Corrections and right of reply
Vendors, researchers and readers can send corrections or statements to security@walletinsights.io. We check them against the sources, update the entry and record the change in its log.
All Trezor incidents
- Suspected implant in a Trezor Safe 5 sold by CryptoBilis
- Breach at shipping provider ShipMonk exposes data of up to 80,689 Trezor customers
- Laser fault injection bypasses firmware checks on Trezor Safe 7's TROPIC01 chip
- Fake Trezor letters demand an "Authentication Check" and the recovery phrase
- Ledger Donjon bypasses Trezor Safe 3 supply-chain protections