Trezor Warns Users as Coldcard Phishing Attempts Rise

Key Point

Trezor warned users not to share recovery seeds as phishing attempts exploiting the Coldcard security vulnerability increase. Trezor said recovery seeds should be entered directly on a Trezor device only when restoring a wallet. Trezor said the company does not ask users for recovery seeds under any circumstances. Trezor said users should ignore wallet migration instructions sent by email, message, or phone, and Trezor said it was not affected by the Coldcard security incident. Galaxy Research said 1,596 BTC has been stolen from 7,300 addresses so far, and the total could rise to as much as 2,055 BTC.

Why it matters: Large wallet-security incidents can weaken self-custody confidence and may push users to verify recovery procedures more carefully.

Market Sentiment

Bearish, Stress-on, Event-driven, Fear.

Reason: Galaxy Research said 1,596 BTC has been stolen from 7,300 addresses so far, which raises wallet-security stress for holders.

Similar Past Cases

The 2022 LastPass breach aftermath showed how compromised secret storage can lead to delayed crypto thefts. CoinDesk reported that hackers siphoned $4.4 million from at least 25 LastPass users on Oct. 25, while more than $35 million had been linked to the breach by another cybersecurity report. (CoinDesk) The difference is that the current incident centers on Coldcard-linked wallet security and phishing claims, while LastPass centered on password vault exposure.

Ripple Effect

Seed-exposure risk can spread through social engineering because attackers can reuse the same recovery-warning narrative across wallet users. If wallet migration messages keep circulating, then the incident could shift from one security event into broader self-custody distrust.

Opportunities & Risks

Opportunities: If Trezor or Coldcard publish additional security instructions, then verifying instructions only through official wallet-device flows can reduce seed-exposure risk.

Risks: If Galaxy Research raises the stolen total toward 2,055 BTC, then reducing reliance on any unverified migration request becomes a defensive signal.