Trezor support portal breach exposes 66,000 contacts
Who is affected
Names and email addresses of up to 66,000 support contacts were exposed, and some then received emails asking for their recovery seed. Trezor states no funds were compromised and the devices were unaffected.
What happened
Trezor states that on 17 January 2024 it identified unauthorized access to the third-party support ticketing portal it uses, and that the access was terminated the same evening. Up to 66,000 people who had contacted Trezor Support since December 2021 may have had their names or nicknames and email addresses exposed; Trezor emailed all of them on 20 January. Trezor adds that 8 people who had registered on a trial discussion platform run by the same vendor may also be affected.
According to BleepingComputer, Trezor believes postal addresses, phone numbers and other personal data stored on the system were not affected. Trezor says no recovery seeds were disclosed and its devices remain secure.
Trezor confirmed 41 cases in which the exposed data was used for phishing: emails posing as an “automated reply” from support asked for the 24-word recovery seed, claiming it was needed for firmware validation.
What Trezor advises:
- If you contacted Trezor Support after December 2021, watch for phishing emails.
- Never disclose your recovery seed; Trezor will never ask for it.
A mnemonic phrase is a set of words that stores a cryptocurrency wallet's private keys, allowing users to recover access if lost.
Read full definitionRecovery is the process of restoring access to a cryptocurrency wallet using its seed phrase or mnemonic backup if the original wallet is lost or inaccessible.
Read full definitionFirmware is the software that runs on a hardware wallet itself: it generates keys, shows transaction details on the screen and signs.
Read full definitionSources
Independent reporting and research this entry was checked against.
Change log
- Checked against Trezor's own statement, now linked; details from it added.
Learn more
Guides on protecting yourself against this type of incident (Customer data breach) and the glossary terms that describe it.
Phishing Defense: Protecting Your Hardware Wallet from Social Engineering
Fake websites, spoofed emails, malicious dApps — how phishing attacks target hardware wallet users and how to spot them every time.
Read GuideHome Invasion and Burglary: Securing Your Crypto Setup
Burglars target crypto holders specifically. How to hide, split, and protect your wallet setup and seed phrase backups at home.
Read GuidePhishing Attack
A phishing attack tricks crypto users into revealing private keys, seed phrases, or login details via fake emails, websites, or messages mimicking legitimate wallets or exchanges.
$5 Wrench Attack
A $5 Wrench Attack is when someone uses physical coercion to force a crypto holder to reveal their private keys or access their funds.
Cite this entry
WalletInsights. “Trezor support portal breach exposes 66,000 contacts”. Hardware wallet security incident tracker. Last verified November 3, 2026. https://walletinsights.io/en/security-incidents/trezor-support-portal-data-breach-2024/
Corrections and right of reply
Vendors, researchers and readers can send corrections or statements to security@walletinsights.io. We check them against the sources, update the entry and record the change in its log.
All Trezor incidents
- Suspected implant in a Trezor Safe 5 sold by CryptoBilis
- Breach at shipping provider ShipMonk exposes data of up to 80,689 Trezor customers
- Laser fault injection bypasses firmware checks on Trezor Safe 7's TROPIC01 chip
- Ledger Donjon bypasses Trezor Safe 3 supply-chain protections
- EUCLEAK side channel in Infineon ECDSA library reaches Trezor Safe 3 and Safe 5 chip