hack

Trezor warned of a phishing email that has been sent out from its official domain due to a third-party security breach.
This follows last month’s security breach at shipping provider ShipMonk, which exposed the personal information of Trezor customers.
Hardware wallet maker Trezor said its third-party email provider had been breached, enabling phishing emails to be sent from its official domain.
"Please be aware that the email named 'Critical Security Alert: STM32 Entropy Vulnerability' is not coming from us, and it's a phishing attempt. Do not click on any link," Trezor wrote in an X post on Wednesday.
Trezor said it has since taken down the domain and is investigating the situation, including how the hackers were able to use its official domain for the phishing emails.
On the same day, BitBox, a Swiss bitcoin BTC-0.50%
hardware walletmaker,reporteda similar phishing email circulating under its disguise.
Marcello Paz, a crypto commentator with X username "MHPaz," said he received the phishing email, sharing screenshots showing that it asked customers to update their hardware wallets due to a "critical" vulnerability that could affect newer devices. The email credentials show official domain names and signatures, unlike typical phishing emails that use similar but fake addresses.
Not the first
Just last month, Trezor disclosed a major security incident in which a breach at its shipping provider, ShipMonk, exposed customers' personal information. While Trezor initially said around 13,700 customers had their names, cities, and email addresses leaked, the company said earlier this month that another 67,000 U.S. customers were affected by the same breach.
In June, Ledger's Donjon security research team disclosed a hardware vulnerability in the TROPIC01 chip used inside the Trezor Safe 7, demonstrating a lab-based laser attack that bypassed the chip's firmware verification system. Trezor said at the time no user funds were at risk.
A 2020 Ledger breach exposed information belonging to more than 270,000 customers, with names, email addresses, phone numbers and, in some cases, home addresses later published on a hacking forum. Ledger customers have continued to report receiving scam phone calls and physical letters years later.
#Bitcoin #Hack #hardware
$BTC

Harmony yaxınlarda icazəsiz ONE mint edilməsi ilə bağlı insident üzrə forensic yeniləməsini açıqlayıb.
Əvvəl bazar ~4B ONE mint edildiyini deyirdi. Amma yenidən qurma isə saxtalaşdırılmış cross-shard issuance ümumi həcminin 6 əməliyyat və 4 hücumçu cüzdanı vasitəsilə ~3.01T ONE-ə çatdığını göstərir.
Ən diqqətçəkən məqam cross-shard receipt replay zəifliyidir:
Hücumçu hələ autentifikasiya edilməmiş Merkle proof daxilindəki identifikatorları dəyişə bilər; nəticədə sistem əvvəl işlənmiş receipt-ləri sanki heç istifadə edilməmiş kimi başa düşür → receipt yenidən verify edilir → hədəf shard ONE-ni kreditləyir, amma mənbə shard-da uyğun debit olmadan.