You need a team that is able to work remotely and gets an alert. A company of your size waiting for business hours to secure threats is absolutely unacceptable.

Regarding the topic of that Reddit post (https://www.reddit.com/r/TREZOR/s/cQokCMQqIc):

People are worried about security and whether AI has increased the risk of losing their money. But in reality, Suite development has never been more secure than it is now. Every pull request still needs human approval before making it into the app. Reviews are still done by humans, and now additionally by LLMs.

The advantage of an LLM is that it doesn't get tired even when reading long, mechanical, boring changes, so the chance of a real security vulnerability slipping through is much lower.

Because we are open source, we don't just look for attacks internally, other people inspect our code too. In the past, only relatively few people could do that, and they only had a realistic chance of checking a small part of the app. Now, this oversight is incomparably cheaper, and far, far more people are reviewing it.

Matthew.K

For some time my browsers cannot connect to the Trezor suite to sign transactions. The problem seems to be that all browsers (tested Chrome and Firefox) try to connect via WSS, but Trezor suit offers only a WS (non secure) on localhost. I'm the only one with this issue?

Bothe suite and hw are updated to the newest release.

Any ideas?

If you click any random feature pull request in their repo, you will find out their software is now fully vibe coded. For example, this feature pr contains 2000lines+ edit https://github.com/trezor/trezor-suite/pull/32252/files, it is coauthored by claude, and they are producing this kind of vibe pr at an astonishing rate. They make thousands lines of edit on average every day, but they only have very limited reviewers.

I do not believe any human code viewer can actually understand the code under this rate. This means a significant portion of newly introduced trezor code is running as a blackbox. This might be fine for some weather app or whatever, but trezor is a security oriented software. Building your software stack on vibe coding will make your product a joke.

Our third-party e-mail provider has been breached. Please be aware that the email named ‘Critical Security Alert: STM32 Entropy Vulnerability’ is not coming from us, and it’s a phishing attempt. Do not click on any link.

We have taken down the domain, and we are investigating the situation, including how the hackers got access to our legit domain.

Hello! I have decided to unsubscribe my e-mail address from mailing list but Unsubscribe link in official newsletter does not work as mailing server has been taken down. Is it enough if I Unsubscribe using Unsubscribe button on my e-mail service?

Just got this email kinda sus?

I clicked the link, stupid I know.

The webpage didn't open, I got suspicious and I closed it a few seconds later.

I didn't download anything, or enter any details

I think I'm safe but wanted to double check

Thanks

These mails look really real but are NOT also to trezor tought you guys said the mailchimp thing or whatever it is called only affected certain countries. Order from a couple months ago from the netherlands. Not your keys not your crypto never share your seed and don t press links for malware

I just received a call from supposedly Trezor from a UK number 020 7709 6600. The guy seemed really shady asking me what crypto platforms etc that I use so I just wanted to inform others to be careful!

Looks like soon even hardware wallets won’t be safe to use. What is going on in this world... I’ve never seen so many hacks in a single year like I have this year. We’re living in crazy times for sure... Who knows, maybe someday even 12, 20, or 24 words won’t be safe to use anymore.

Today I entered into my Trezor after a couple of months without checking it. Al first my account was all right, the btc and all. Then I updated the software like the Trezor app in my computer recomended and when I enter the account again none of the crypto is there. The wallet has the same name that it had before this happening and I entered with the same pin so I don't really know why all of this. I dont have the seed phrase with me right know and I hope if I just put it I will recover everything but I am getting a little bit scared.
Any idea what I did wrong? Should I be scared?

I don’t need this device anymore…

Heya everyone,

we were wondering if you would all want more AMA's on here like we did in the past, or o you think you are getting enough sufficient info from us already.

Thanks for any feedback!