Wrong! Hardware wallets make it more difficult for attackers to phish you, but here’s how they’re currently doing it. Take a look at a new phishing kit targeting users of Trezor hardware wallets.

Step 1: Get sent a phishing link

The first stage involves receiving a phishing link. This could have been through any medium, but in the crypto space the popular options include Telegram, Email, Twitter, Discord, or Reddit.

If you click on the link, you’ll get taken to this page:

This is a near perfect clone of the standard Trezor onboarding process.

Step 2: Build trust

The scammers in this case have included the same warnings that Trezor show you to ensure that your device has not been tampered with. By default, Trezor ships with holographic tamper evident seals on their packaging that let the end user know whether the device has been opened in transit to the user.

Including safety information like this in a phishing site is a common strategy used by attackers to lull the end user into a false sense of security. Next, the screen below is shown, which includes instructions to “Connect your Trezor to continue”.

The phishing kit has a built in delay that triggers the final stage, whether or not you connect your Trezor device.

Step 3: Killshot!

Now that you’ve walked the journey through the attacker’s phishing website, the final part of the process begins.

A popup box appears notifying you of a “Hardware Error” that requires you to enter your 12 word recovery seed to restore your wallet. Of course, if you do so, your recovery seed is sent off to the attacker’s server and your crypto will be swept out of your wallet in a matter of minutes.

Staying Safe Online

Are hardware wallets a bad idea? Absolutely not. Using a hardware wallet is one of the safest ways to store your funds currently. In fact, we highly encourage anyone reading this to get one. However, remember that you’re not immune to the biggest security risk in the crypto industry right now — phishing. Here are our top tips on staying safe online:

• Use PhishFort’s Brand Protection Services for Crypto.
• Read our guide How to Protect Your Crypto Wallet on protecting yourself from phishing.
• Take the fantastic Google Phishing awareness training tests or learn more about it in the Binance Academy section about phishing.