Trezor Suite Schwachstelle Erc 20 (Spam-Adressen)

[root_s2yse8vt]

Up

0

Down

::

Hallo, ich möchte die Trezor Suite Sicherheitslücke teilen. Zunächst habe ich eine Testtransaktion im ERC20-Netzwerk für eine 20$-Börsengeldbörse (die niedrigste) durchgeführt. Das Geld ist angekommen. Die Transaktion wird als ausgehend angezeigt. Danach, eine Minute später, erschien eine weitere Spam-Transaktion, ebenfalls als ausgehend getarnt (aber ohne Provision), bei der die ersten 5 und die letzten 4 Zeichen der Wallet-Adresse übereinstimmten. Dorthin habe ich mein Geld geschickt. Der Betrüger hat bereits $ 160.000 gesammelt)

Ich hoffe, dass dies für jemanden nützlich ist. Wir zahlen teuer für Fehler.

https://preview.redd.it/xx9ag3tq4e5b1.jpg?width=1280&format=pjpg&auto=webp&s=bfed4dd9d4fffe68c6d722d27f5526bfed4cc37b

[comfyggs]

Up

0

Down

::

This is entirely your mistake op. Sorry. Nothing to do with Trezor or suite

[isit2amalready]

Up

0

Down

::

This is not a Trezor vulnerability its just spam. Just like you get in your Gmail. That’s why you never copy and paste the “last transaction” in your history as it could have been one of the spam ones.

I do agree Trezor can do something to highlight these as potential spam transactions like Etherscan is doing now.

[mcgravier]

Up

0

Down

::

People, stop being toxic to this guy, he lost a lot of money ffs.

As for

> where the first 5 and last 4 characters of the wallet address matched

Would you share the spam address and the real one with us? It’s not recommended due to privacy issues, but wider community would benefit from this

Also it’s worth contacting Trezor support – they may implement some countermeasures in the future after all

[Upstairs_Tomorrow614]

Up

0

Down

::

Congratulations, You’ve just learned a hard lesson on what’s called address poisoning. Trezor has no blame in this; prob have forums on how to avoid this. Find some time and read up on this.

[mcbelisle]

Up

0

Down

::

don’t understand. did you send a test transaction or a spam transaction?

[brianddk]

Up

0

Down

::

OP, sorry for your loss

Future readers, here is the applicable note in the manual

> The most important step in avoiding this type of scam is to thoroughly verify and double-check the address before confirming the transaction on your Trezor. This is crucial for all transactions, but especially when sending assets of significant value. The only way to ensure safety is to carefully check every character of the address.

– ***[The Manual](https://trezor.io/support/a/address-poisoning-attacks)***

[Joe_thefranco]

Up

0

Down

::

It is called “dusting” and can happen on any wallet. You failed to verify your full addresses, sorry for your loss.

[comfyggs]

Up

0

Down

::

This has NOTHING to do with Trezor suite. Please educate yourself

[EfraimK]

Up

0

Down

::

OP, could you share some more details about or clarify what happened? What do you mean by, “After it, a minute later, another spam transaction appeared”? Are you saying you saw another transaction on your Trezor to confirm having the same first and last characters as the transaction you’d recently confirmed?

FWIW, I don’t think it makes any sense to ridicule or debase people for making mistakes. And tech companies should anticipate mistakes and improve their products by compensating for them (like cars’ annoying beeping if drivers forget to engage their seat-belts…). The objective ought to be making crypto safe for everybody, not gloating over others’ losses due to mistakes.

[loupiote2]

Up

0

Down

::

This is scam is called “Address Poisoning Attacks”. They are very common.

You should NEVER copy a dest address from a previous transfer you did and that you see on a blockchain explorer, because the transfer you see may in fact be a fake / scam transfer using address poisoning.

This has nothing to do with Trezor. This scam targets any transfer done using any wallet.

However, if Trezor tools show your Tx’s on the blockchain, they should definitely hide or flag those fake Tx’s made on your account.

[GaRGa77]

Up

0

Down

::

Bitcoin only firmware FTW

[JerryGallow]

Up

0

Down

::

[Some info on this.](https://np.reddit.com/r/ledgerwallet/comments/106etj2/comment/j3gcmsb/?utm_source=share&utm_medium=web2x&context=3)

[More info.](https://np.reddit.com/r/ledgerwallet/comments/10n3lwq/comment/j67jqfm/?utm_source=share&utm_medium=web2x&context=3)

[c4shm3n]

Up

0

Down

::

i was also scammed now ….sad and completely not to understand how is that possible with TREZOR????

[[deleted]]

Up

0

Down

::

[deleted]

[bat-affleck-is-back]

Up

0

Down

::

I dont get it, test tx arrived.

There’s new 0 value tx… and you copy paste the address? Isnt that defeat purpose of having the test tx?

[Autor]

Beiträge