🔤 UPD: Trezor Data Leak Is Much Bigger Than We Thought

Без текста

Без текста

🔤 UPD: $115M COLDCARD Hacker Starts Moving the Bitcoin 🟠Remember the COLDCARD seed-generation flaw that allowed attackers to reconstruct weak private keys and drain thousands of wallets? The stolen funds are finally starting to move. 🟠According to Galaxy Digital’s Alex Thorn, the third-wave attacker moved stolen $BTC on-chain for the first time, swapping part of it into $ETH through THORChain — likely the beginning of the laundering and cash-out phase. 🟠The scale is now estimated at 1,789.28 BTC worth roughly $114.7M, stolen from 8,865 addresses across the full series of attacks. Until now, funds from all three waves had reportedly remained sitting in the attackers’ original wallets. 🟠The hacker is apparently having some trouble. Several THORChain swaps were reportedly refunded, but attempts to move the Bitcoin continue. Around 90% of the third-wave funds still haven’t moved. 🟠Thorn says the BTC routed through THORChain has already been traced to new Ethereum addresses, with the information shared with authorities and crypto companies. Moving across chains may complicate tracking — but it also creates an entirely new trail for investigators to follow. 🟠The exploit phase is basically over. Now comes the harder part for the attacker: turning $115M of publicly traceable stolen Bitcoin into spendable money without touching infrastructure willing to freeze it. 👉 Stealing crypto is one problem. Laundering nine figures on a public blockchain is another.

Без текста

🔤 UPD: Trezor’s Official Domain Is Now Sending Phishing Emails 🟠Remember the Trezor data leak that exposed personal information belonging to tens of thousands of hardware wallet customers? Now there’s another problem — attackers reportedly compromised Trezor’s official domain and used it to distribute phishing emails. 🟠According to Trezor, the attackers gained access through a third-party email provider and started sending fake warnings about a supposed “critical vulnerability.” 🟠This makes the attack especially dangerous. These aren’t random emails from an obviously fake Trezor address — the messages were reportedly being sent through official Trezor infrastructure, giving victims another reason to trust them. 🟠Combine that with previously leaked customer information — names, emails, phone numbers, shipping addresses and order history — and attackers potentially have everything needed for extremely convincing targeted phishing campaigns. 🟠Trezor says it has disabled the affected domain and is investigating the compromise. Users should avoid clicking links in suspicious Trezor emails and access services directly instead. 🔓 First they got the customer list. Now they got the trusted sender. That’s how phishing becomes dangerously convincing.