Trezor wallet : breach exposes data of 60,000+ customers

[joniboini]

It's great that Trezor doesn't have a recovery function. Leadger - should have made this feature free. I don't understand how you can store your cryptocurrency there if your cid phrase is known to someone else. Where is the anonymity they are talking about? So they say one thing and do another? So it turns out. 

They should never made a feature like that honestly, just goes to show that a closed-source wallet is just not it. That being said, if you want to buy a Trezor wallet, make sure you are aware that they do have some issues (albeit not directly related to the hardware itself) such as this one. If you plan on using your main e-mail address, always double-check so you don't click some random links. Trezor, Ledger, and even wallet that don't have a company like Electrum names are used for phishing attacks. CMIIW.

[Charles-Tim]

Trezor, Ledger, and even wallet that don't have a company like Electrum names are used for phishing attacks. CMIIW.

It is simple as Electrum do not ask for email or any personal information. Noncustodial wallets like Sparrow and many other ones do not ask for email and other information from customers. From what I have noticed, only hardware wallets are asking for such information, like while buying the wallet, or subscribing to their newsletter which was what that happened to recently, to those that subscribed to trezor newsletter. Anywhere you provide your email or any other personal information, expecting phishing or your information to be used for something not good.

[NikeFit_7777]

They should never made a feature like that honestly, just goes to show that a closed-source wallet is just not it. That being said, if you want to buy a Trezor wallet, make sure you are aware that they do have some issues (albeit not directly related to the hardware itself) such as this one. If you plan on using your main e-mail address, always double-check so you don't click some random links. Trezor, Ledger, and even wallet that don't have a company like Electrum names are used for phishing attacks. CMIIW.

Leadger is not a cold wallet for me personally. What they did is not acceptable to me. Therefore, I am interested in hearing from people who have used Trezor. I would like to know the opinion of everyone who has used it. Have you personally been caught phishing through the mail? Thanks for the information, I'll be aware of it in the future.

P.S. Another question, how long (in terms of time) did the parcel with the device go? Up to 1 month? Or more? If you ordered of course and how was the package packaged? 

[paid2]

Leadger is not a cold wallet for me personally. What they did is not acceptable to me. Therefore, I am interested in hearing from people who have used Trezor. I would like to know the opinion of everyone who has used it. Have you personally been caught phishing through the mail? Thanks for the information, I'll be aware of it in the future.

I used a Ledger Nano S for years, and in parallel a Trezor Model One. I prefer the Trezor, and Trezor suite is better than Ledger App IMO. Trezor is open source and at least with their app you have Coin Control, can sign messages easily etc.. Doable too with Ledger but less noob-friendly imo. 

With Ledger you will have more altcoins available in the desktop app from scratch.
I was not "phished" by Trezor nor Ledger.

P.S. Another question, how long (in terms of time) did the parcel with the device go? Up to 1 month? Or more? If you ordered of course and how was the package packaged? 

The Trezor was sent from Czech Republic to me, in Bulgaria, with DHL if I remember well. It took 4 or 5 days. It was well packaged, nothing negative to say.

[Sim_card]

It's just to spread the word: be careful, verify the emails and links you receive if you're using a Trezor, there's been a leak from their database recently.   

I hope nobody lost coins or send anything to scammers, but Trezor should get your shit together !
How many times we need to hear the same story about hacked database from hardware wallets and information form customers until you learn to protect it correctly

None of their customers lost their funds as they were able to notice this on time and there was no report on customers losing their funds. The problem was fixed not long after the breach of data, and all those that they phishing link was sent to their email were smart enough not to click on the phishing link. Trezor needs to step up their security so that such will not happen in future again, if not their users will lose trust in Trezor.

[NikeFit_7777]

I used a Ledger Nano S for years, and in parallel a Trezor Model One. I prefer the Trezor, and Trezor suite is better than Ledger App IMO. Trezor is open source and at least with their app you have Coin Control, can sign messages easily etc.. Doable too with Ledger but less noob-friendly imo. 

With Ledger you will have more altcoins available in the desktop app from scratch.
I was not "phished" by Trezor nor Ledger.

Thanks for the information, of course. But for me personally, Leadger is not a cold wallet - if there is a recovery, automatically minus. It's a good thing I didn't buy it, it would have been a waste of money + time. Question: "After updating the recovery - you were not required to force a firmware update of the Leadger itself?". It's interesting to hear the answer to that.

P.S. I'd better do some more research about Trezor, as practice has shown that in this case it's better not to rush.

The Trezor was sent from Czech Republic to me, in Bulgaria, with DHL if I remember well. It took 4 or 5 days. It was well packaged, nothing negative to say.

I see, so you have to look at the site itself when placing a particular order. 

[paid2]

Thanks for the information, of course. But for me personally, Leadger is not a cold wallet - if there is a recovery, automatically minus. It's a good thing I didn't buy it, it would have been a waste of money + time. Question: "After updating the recovery - you were not required to force a firmware update of the Leadger itself?". It's interesting to hear the answer to that.

P.S. I'd better do some more research about Trezor, as practice has shown that in this case it's better not to rush.

Yeah I am not a big fan of what Ledger did recently either. I cannot answer for the firmware update as I stopped using my Ledger in early 2023 IIRC. I shouldn't have bought a closed source HW but when I started mining (years ago) I was not educated on the topic and bought a Ledger pretty randomly.

You're right, never rush when it come to money  
Trezor is a safe bet IMO, but some other are nice too of course. I will soon try to make my first pitrezor, and will do a topic aboout it here.

[NikeFit_7777]

Yeah I am not a big fan of what Ledger did recently either. I cannot answer for the firmware update as I stopped using my Ledger in early 2023 IIRC. I shouldn't have bought a closed source HW but when I started mining (years ago) I was not educated on the topic and bought a Ledger pretty randomly.

You're right, never rush when it come to money  
Trezor is a safe bet IMO, but some other are nice too of course. I will soon try to make my first pitrezor, and will do a topic aboout it here.

Honestly? I don't see how, after what they did. Users can buy devices and use them. Personally for me it's the same as keeping money not in a cold wallet. Where's the guarantee that tomorrow without a firmware update you won't be able to use your device? That's right, no guarantees.

Absolutely right, there's no rush, and why should there be? I'm glad the Trezor campaign didn't think of doing something like this (what the Leadger campaign did). I'd rather study the information + listen to other users' opinions. I take it you don't use this device?   

[bettercrypto]

That's a bit of bad news for Trezor users. It seems like even hardware wallets today are hard to trust when there is a breach issue like that. The Trezor has been around for a long time, and suddenly there was such a problem.

I just hope their Trezor user clients don't get traumatized because of that problem. Hardware wallets are expensive, and when this happens, it seems that it is very difficult to find and trust hardware wallets.

[joniboini]

That's a bit of bad news for Trezor users. It seems like even hardware wallets today are hard to trust when there is a breach issue like that. The Trezor has been around for a long time, and suddenly there was such a problem.

I don't think this will change how users trust the security of the wallet though, this data breach is not related to that in any way. If anything some of them will look for a better alternative to protect their privacy if they need to buy from Trezor directly, while some will probably build their own wallet using their open-source code. Obviously, if they include a very sensitive data such as users' wallet address, things will be different. CMIIW.

[paid2]

I don't think this will change how users trust the security of the wallet though, this data breach is not related to that in any way. If anything some of them will look for a better alternative to protect their privacy if they need to buy from Trezor directly, while some will probably build their own wallet using their open-source code. Obviously, if they include a very sensitive data such as users' wallet address, things will be different. CMIIW.

You're right, this problem has more to do with personal data and user privacy than with their funds directly.

But we shouldn't think that this is a trivial matter either, because based on the information that has been leaked, social engineering or other techniques could be used in some cases to access funds indirectly.

[joniboini]

But we shouldn't think that this is a trivial matter either, because based on the information that has been leaked, social engineering or other techniques could be used in some cases to access funds indirectly.

Oh, that's for sure. I didn't think I implied that this was not a serious matter, sorry if that was the case. I thought saying people will try to find better ways to buy or build their own wallets means this can definitely affect Trezor in one way or the other. On the other hand, a phishing attack due to a leaked database is not new, so people should realize that any suspicious e-mail related to their wallet is probably a scam attempt. At the end of the day, hopefully, Trezor will learn from this and choose a better provider or a better way to store customer data for support purposes and not store something even more sensitive like I've mentioned above.

[bitmover]

The problem came from an external company that takes care of email services for the Trezor. Sending newsletters and similar. Almost every serious company works like that. A similar thing happened to some other "big" names, it was talked about here on the forum https://www.altcoinstalks.com/index.php?topic=316040.msg1478541#msg1478541

I think crupto community is too harsh with companies.
Ledger faced a similar problem in the past, and now every comment about ledger is negative in reddit, btt  etc..

I don't agree  with that
 I own a ledger and I like it. I don't support the recovery tool about sending the seed online, but luckily it is not available in my device.

Does anyone use this (cold) wallet? If yes, please answer me a few questions.

— Does Trezor have a recovery function like Leadger?
— Does Trezor have forced firmware update? If I don't want to update the firmware, can I not do it? Will I have access to my funds?
— Who has had problems with the device itself?

I have both wallets, Trezor and Ledger. I primarily and almost exclusively use Trezor, while Ledger is more for experimentation (for example, I only use it for tokens and some rare altcoins)

Answer to your question (if they are not rhetorical)
- No
- No
- Since I have Trezor One, my only problem is that I don't have support for some of the more important Altcoins.

btw. I use the Trezor wallet almost on a daily basis, it's not just for hold.

Ledger has way more functionality
Supports every altcoin out there, and it is very safe to use.

[examplens]

I think crupto community is too harsh with companies.
Ledger faced a similar problem in the past, and now every comment about ledger is negative in reddit, btt  etc..

I don't agree  with that
 I own a ledger and I like it. I don't support the recovery tool about sending the seed online, but luckily it is not available in my device.

If the only problem with Ledger was that there were leaked email addresses, I believe that it would be "forgiven" somehow. But they screwed up the matter in more ways than one. BS with private keys is certainly much more serious than the problem with the database of email addresses.
It is enough when someone says "luckily it is not available in my device." It is all about trust in them.

[paid2]

I agree, for a long time Ledger was an okay option, but it's clearly their way of communicating and their commercial strategy which's slowly killing them.

I've completely stopped using mine because I don't want closed source wallets for my coins anymore, but I agree that the email database leak didn't scare me at the time. I thought they at least had an opportunity to learn from their mistakes...

I have to admit that since I switched to Trezor and Electrum on airgapped computers, I'm a bit more relaxed.