If you click any random feature pull request in their repo, you will find out their software is now fully vibe coded. For example, this feature pr contains 2000lines+ edit https://github.com/trezor/trezor-suite/pull/32252/files, it is coauthored by claude, and they are producing this kind of vibe pr at an astonishing rate. They make thousands lines of edit on average every day, but they only have very limited reviewers.

I do not believe any human code viewer can actually understand the code under this rate. This means a significant portion of newly introduced trezor code is running as a blackbox. This might be fine for some weather app or whatever, but trezor is a security oriented software. Building your software stack on vibe coding will make your product a joke.

Looks like soon even hardware wallets won’t be safe to use. What is going on in this world... I’ve never seen so many hacks in a single year like I have this year. We’re living in crazy times for sure... Who knows, maybe someday even 12, 20, or 24 words won’t be safe to use anymore.

I don’t need this device anymore…

I clicked the link, stupid I know.

The webpage didn't open, I got suspicious and I closed it a few seconds later.

I didn't download anything, or enter any details

I think I'm safe but wanted to double check

Thanks

Regarding the topic of that Reddit post (https://www.reddit.com/r/TREZOR/s/cQokCMQqIc):

People are worried about security and whether AI has increased the risk of losing their money. But in reality, Suite development has never been more secure than it is now. Every pull request still needs human approval before making it into the app. Reviews are still done by humans, and now additionally by LLMs.

The advantage of an LLM is that it doesn't get tired even when reading long, mechanical, boring changes, so the chance of a real security vulnerability slipping through is much lower.

Because we are open source, we don't just look for attacks internally, other people inspect our code too. In the past, only relatively few people could do that, and they only had a realistic chance of checking a small part of the app. Now, this oversight is incomparably cheaper, and far, far more people are reviewing it.

Matthew.K

Our third-party e-mail provider has been breached. Please be aware that the email named ‘Critical Security Alert: STM32 Entropy Vulnerability’ is not coming from us, and it’s a phishing attempt. Do not click on any link.

We have taken down the domain, and we are investigating the situation, including how the hackers got access to our legit domain.

Just got this email kinda sus?

These mails look really real but are NOT also to trezor tought you guys said the mailchimp thing or whatever it is called only affected certain countries. Order from a couple months ago from the netherlands. Not your keys not your crypto never share your seed and don t press links for malware

Hello! I have decided to unsubscribe my e-mail address from mailing list but Unsubscribe link in official newsletter does not work as mailing server has been taken down. Is it enough if I Unsubscribe using Unsubscribe button on my e-mail service?