Background: Crypto hardware wallet-maker Trezor recently disclosed a customer data breach in one of their shipping partners.
This is problematic for crypto users in particular, since having one’s home address revealed opens you to so-called “wrench attacks” – which is why we recommend using PO boxes for receiving potentially sensitive items where disclosing your home address could pose security risks.
Now that Trezor customers’ addresses are out in the wild, some are reporting postal delivered letters purporting to be from the company, advising them to “migrate their wallets” to a secure upgrade.
A few issues come to light, including that QR codes can be malicious.
Even if this was a legitimate letter (it empathically isn’t), you should at the very least, use a separate QR code scanner tool that can show you what information is encoded.
In this case we can see that it’s not to the official Trezor domain, but to an io-qr.cc subdomain named “trezor” on a QR code redirector service.
We can plug that in to a Link Expander / Redirect Chain and trace all the hops:
…and we can see that we’ll ultimately end up on a “qr-trezor” domain that was registered on Sept. 3rd via Nicenic, and using Cloudflare (surprise, and surprise).
Of course, this is all to lure the recipient to this page:
Where you will duly be prompted for your seed phrase and your wallet drained.
It’s somewhat novel to see a snail mail crossover for an address breach attack vector, but it highlights the risks of malicious QR codes and, as always, lookalike domains.
We’ve added the malicious links to the Domainsure Crypto Defender Threat Feeds, and we previously didn’t know about io-qr.cc, which has been added to the Public URL Redirectors feed (PURLs) – the latter is not a block list, it’s there for developers to integrate into their link sanitization workflows (there is also an agentic skill for “Is This a Redirect?” over on DNSskills.md).
The Trezor data breach comes at the worst time, as many users (the author included) were buying them to get out of the blast radius from July’s Coldcard hack.
Apply for a Domainsure Invite
Get a Free Domain Health Check
Due to high demand: allow up to 24 hours for report delivery.
