Trezor, a cryptocurrency hardware wallet company, has initiated an investigation into a probable data breach of an ongoing email phishing campaign which has been reported by various users on Twitter. On April 3, numerous users warned about an ongoing email phishing campaign targeting Trezor wallet owners via their registered email accounts. Several Trezor users have been approached by unauthorized actors posing as the company in the ongoing campaign, with the goal of stealing cash by deceiving unsuspicious investors.

As part of the attack, users received an email about downloading an app from the “trezor.us” domain, which is different from the official Trezor domain name, “trezor.io”.

Trezor initially suspected that the compromised email addresses belong to a list of users who opted in for newsletters, which was hosted on an American email marketing service provider Mailchimp. While Trezor attempts to identify the root cause of the situation with an official investigation, users are advised not to click on links coming from unofficial sources until further notice.

“MailChimp [has] confirmed that their service has been compromised by an insider targeting crypto companies,” Trezor said in a subsequent post. “We have managed to take the phishing domain offline. We are trying to determine how many email addresses have been affected.”

“We will not be communicating by newsletter until the situation is resolved. Do not open any emails appearing to come from Trezor until further notice. Please ensure you are using anonymous email addresses for bitcoin-related activity,” the firm went on to say.

Trezor users began to circulate warnings and screenshots of the phishing attempt on Saturday. Per the messages, the phishing attack was an attempt to induce users to download malicious code under the guise of Trezor’s Suite desktop app by alleging a fake security breach at the company.

Trezor isn’t the only crypto company that suffered a data breach in recent times. About two weeks ago, BlockFi informed investors of a data breach and the possibility of phishing attacks. The breach resulted from hackers gaining access to the data of BlockFi clients through Hubspot. The firm confirmed that personal information such as passwords, government-issued IDs, and social security numbers wasn’t affected because they’re not stored on Hubspot.

Cryptocurrency is an unregulated digital currency, not a legal tender and subject to market risks. The information provided in the article is not intended to be and does not constitute financial advice, trading advice or any other advice or recommendation of any sort offered or endorsed by NDTV. NDTV shall not be responsible for any loss arising from any investment based on any perceived recommendation, forecast or any other information contained in the article.