Phishing 3.0: Why Fake Now Looks Real in Crypto’s Inbox Wars
Trezor has confirmed a new phishing method that abused its support auto-reply emails to target users with realistic scams—despite no actual data breach occurring.
In late June 2025, hardware wallet provider Trezor confirmed a novel and insidious phishing attack targeting its users. The exploit didn’t involve a security breach or database leak. Instead, attackers used Trezor’s own contact form to trigger legitimate auto-reply emails, which were then used to launch convincing phishing campaigns.
When Help Desks Turn Hostile
The attackers submitted support tickets using email addresses of real users. This triggered Trezor’s automated response – an official-looking email from the company. The scammers then followed up with phishing content, piggybacking on the legitimacy of the first message.
Trezor emphasized that their databases and contact form were not compromised, stating: “There was no email breach. Our contact form remains safe and secure.” Yet the implications are serious: users received emails that looked authentic, despite no actual hack occurring.
This isn’t Trezor’s first brush with email-driven threats. Past incidents have included the 2022 Mailchimp breach, where compromised email lists were used to send fake Trezor software updates. More recently, phishing campaigns have mimicked everything from hardware wallets to airdrop banners.
Phishing by Design: When UX Becomes the Weak Link
This incident signals a broader shift in how phishing works. It’s no longer about breaking in – it’s about blending in. Rather than compromise infrastructure, attackers now exploit communication habits and design defaults. As one user noted, “You’re not hacking the system; you’re hacking the user’s trust.”
And trust is fragile. In May, one victim lost $2.6 million in stablecoins after falling for two phishing scams within three hours. That same month, CoinMarketCap and Cointelegraph suffered temporary breaches that served malicious banners prompting wallet verifications.
What do these attacks have in common? They don’t exploit code. They exploit the space between what looks real and what is.
Trust as the Attack Vector
Attackers contacted our support on behalf of affected addresses, triggering an auto-reply as a legitimate Trezor support message.
— Trezor, June 23, 2025
This is phishing 3.0: not sloppy grammar and sketchy URLs, but automated emails and clean interfaces. The fake becomes indistinguishable from the real because it is built on the real.
Trezor’s past incidents (via Mailchimp (2022), SendinBlue (2024), and now contact form auto-replies) show how modern phishing is about identity impersonation and message relay.
Competitors haven’t been spared. Ledger suffered a notorious data leak in 2020, exposing customer emails and triggering a tsunami of scam attempts. MetaMask, Trust Wallet, and others have dealt with fake support impersonations across social and email platforms.
Why Standard Advice Isn’t Enough Anymore
Never share your seed. Ever.
— Trezor
That core message, while eternally true, may no longer be sufficient. As one user noted, if your inbox can be weaponized using legitimate headers and trusted domains, the battle shifts from protecting your secrets to questioning your reality.
This is especially true in moments of stress. A user reporting an issue may be more likely to click a follow-up email. This creates a high-risk window where social engineering meets design familiarity.
Calls for zero-knowledge identity tools and more secure support verification protocols are growing louder. Suggestions include including unique codes in support replies, which could be confirmed via a second channel.
Phishing Is Now Infrastructure
The Trezor case is a reminder that phishing has evolved into a native layer of crypto UX. It thrives not on exploits, but on defaults – on automated replies, banner ads, and newsletter headers.
Security experts now argue that phishing defense requires more than personal caution. It demands systemic redesign. Until then, the most vulnerable part of any crypto wallet may not be the device – it’s the inbox.
The content on The Coinomist is for informational purposes only and should not be interpreted as financial advice. While we strive to provide accurate and up-to-date information, we do not guarantee the accuracy, completeness, or reliability of any content. Neither we accept liability for any errors or omissions in the information provided or for any financial losses incurred as a result of relying on this information. Actions based on this content are at your own risk. Always do your own research and consult a professional. See our Terms, Privacy Policy, and Disclaimers for more details.
Articles by this author
