My BTC and ETH transferred out May 15

I received the phishing emails about manually updating my Trezor Model T after the merge, but didn’t do anything with them, since I suspected they were a scam. I had transferred all my BTC and ETH back in November as various exchanges were having trouble. This is the first time I’ve checked my device, and it shows all my BTC and ETH transferred out in May. I did create a hidden wallet at some point, but there’s nothing in there. Any ideas on where I should start looking?

Hi @Litewriter,

Could you please clearify –

Is this from the Standard wallet or your Hidden wallet?

Please check that you type the Passphrase exactly as it was created, with large and small letters and any spaces are also characters. When you open the Hidden wallet, make sure Trezor Suite doesn’t say a new empty wallet was created for you.

It was from the Standard wallet. I go to Accounts in the Suite and the graphs for BTC and ETH show a green bar for Nov 22 (which is when I was consolidating my remaining coins kept in other wallets), then a red bar for May 2023. Below the graph are 3 blocks showing # of transactions for that time period, the amount in, and the amount out.
I only have 1 Hidden wallet, and a note to myself that I created it for the ETH merge. Did I get taken by that blasted phishing email? I simply don’t remember. It sounded serious, I got no reply when I sent an email to Trezor, but I have my doubts because I remember being quite skeptical. I don’t THINK I got taken, but …
There is no indication that this is an otherwise new hidden wallet. I have to type my passphrase and verify on my device. And since it’s empty, I’m prompted to do it again.

Maybe, it’s quite common to be scammed through phishing emails. SatoshiLabs – the company that makes Trezor – don’t send emails to users unless you have an open ticket and they’ll never ask for your Recovery seed. So if you replied to that email with your Trezor’s Recovery seed included, then it was surely a scam.

Do you run the latest version of Trezor Suite? I’m not sure, but I think they’ve changed the messages you get when a new Hidden wallet is created for you. I have to check. Before, I seem to remember that the Passphrase prompt would loop in some cases, so you’d be asked again and again for the same thing … but I haven’t done that in a while so I’d have to check that too.

I updated the Trezor Suite at the prompt when I opened it at the start of all this. I just checked the dongle and it’s asking me to update the firmware, so apparently it was only the suite. Would it do any good to update the firmware at this point?

To avoid problems later you should upgrade the Firmware every time you’re prompted to upgrade. You can check in Trezor Suite if you have the latest Firmware by going to Settings → Device → Firmware.