1Sem.·

WARNING: Phishing!

If you've just received an email from $BTC (+0,27 %) from Bitbox, Trezor, CoinTracking, or others, please don’t click on anything and under no circumstances enter your 12- or 24-word recovery phrase anywhere!

I’ve received two emails myself from Bitbox and CoinTracking. Both appeared to come from legitimate sender addresses. They were put together very, very professionally... please be careful😘

https://x.com/blocktrainer/status/2097777779056201834

x.comBlocktrainer (@blocktrainer) on X

19 Commentaires

capital_captain_2693@capital_captain_2693

1Sem.

Thanks for the info

•

Carsten@Carsten1970

1Sem.

Could this be related to the "pocket" incident—that the perpetrators obtained the email addresses from that incident?

•

Paul@paul_finesse_

1Sem.

@Carsten1970 That's an interesting theory. I also received the notification about Pocket. I actually use Pocket for shopping, too.

•

Carsten@Carsten1970

1Sem.

@paul_finesse_ According to Pocket, my data has also been compromised, and I've made purchases through Pocket before. That's why I had this idea.

•

Stefan21@stefan_21

1Sem.

@Carsten1970 I had thought of something like that, too. Or the 21Bitcoin incident—email addresses were stolen there as well...

But it seems as though the shared email service Brevo has been compromised:

https://www.blocktrainer.de/blog/phishing-welle-gegen-bitcoin-nutzer-gefaelschte-newsletter-von-bitbox-trezor-cointracking

•

Carsten@Carsten1970

1Sem.

@stefan_21 That sounds plausible, too

••

Paul@paul_finesse_

1Sem.

@Carsten1970 Are you still shopping at Pocket, or did you change your email address as well?

••

Carsten@Carsten1970

1Sem.

@paul_finesse_ I haven't shopped at Pocket in a long time. I've been using Strike for quite a while now—mainly because of the cost.

•

Chris@Psychedelic_Sunflower

1Sem.

It was well done overall, but the fact that the email from "Bitbox" was in English immediately made me suspicious. Their newsletters are usually always in German.

•

Carsten@Carsten1970

1Sem.

I just got one too. The sender appears to be bitbox.swiss.

That email is really well done.

Always keep your eyes open.

•

Paul@paul_finesse_

1Sem.

@Carsten1970 I got that, too

••

Donkey Diktator@DonkeyInvestor

1Sem.

I only noticed it because of the URL in the link. Curious as I am, I clicked on it anyway (of course, from a device that wasn't connected to my coins). It actually asks you to enter your seed phrase right in the browser.

Right above the link in the email

"NEVER enter your recovery phrase on a website or share it with anyone, and only check for updates on official BitBox channels."

I'm sure some people do it anyway.

•

🏊🏻‍♂️ • 🚴• 🏃‍♂️ Endurance Life@MozartsGeist

1Sem.

@DonkeyInvestor Little donkey, what a relief that we have "biological cyber security" up and running in your stable… we're totally safe there!! 🫢

•

Stefan21@stefan_21

1Sem.

@DonkeyInvestor Yeah, I noticed it through the link, too. And it seemed weird to me that it would be a hardware problem that only occurs with certain firmware versions 😅

•

Donkey Diktator@DonkeyInvestor

1Sem.

@stefan_21 and that the email was in English. Bitbox usually writes to me in German

•

Pelo@pelo

1Sem.

Nothing on my side with Tangem 😴

••

Stefan21@stefan_21

1Sem.

@pelo That's great. But please be aware that with Tangem, you're exposed to risks that are quite different from those associated with a Bitbox or Trezor. Tangem doesn't have a display. As a result, you don't know exactly what you're signing with your hardware wallet. You have to rely on what your smartphone screen tells you. And that could always be wrong. Tangem is therefore more comparable to a software wallet than a hardware wallet.

•

Pelo@pelo

1Sem.

@stefan_21 I agree that’s the negative part but in the same time u have no update firmware to do so u reduce the risk of a malware

•

Stefan21@stefan_21

1Sem.

@pelo Fair point, no firmware updates does close one attack vector. But the malware you should worry about isn't on the card, it's on the phone. With Tangem, the phone is your only screen: the app builds the transaction, shows it to you, and the card signs whatever it gets. If the phone is compromised, the card can't protect you because it has no way to show you what it's actually signing. A Bitbox or Trezor verifies the address and amount on its own display, independent of the computer or phone.

Also, "no updates" cuts both ways - if a bug is ever found in the card's firmware, it can never be patched.

Not saying Tangem is useless, I just wouldn't treat it as equivalent to a real hardware wallet for larger amounts :)

•