Trezor warns of phishing after email provider breach

Trezor, the company behind the hardware wallets used to store cryptocurrency, warned customers on Wednesday about a phishing campaign. The attack became possible after intruders broke into a third-party email service provider used by the manufacturer.

Those affected received emails with the subject line “Critical Security Alert: STM32 Entropy Vulnerability,” sent from the legitimate address help@trezor.io. The messages claimed that a “hardware microcontroller vulnerability” had been discovered in the STM32 microcontrollers used in Trezor's cold wallets, supposedly allowing a seed phrase to be brute-forced. The whole ploy counted on a frightened wallet owner clicking the link and handing over their secret data.

Trezor stresses that the email did not come from them, and urges customers under no circumstances to follow the links. The company said the malicious domain has already been taken down, and that the circumstances of the incident are being investigated — including how the attackers gained the ability to send messages from the genuine domain.

Not the first leak this year

This is not the first unpleasant episode for Trezor in recent times. In August, the company disclosed a data breach that occurred after a hack of its logistics partner ShipMonk. In that case, order details were stolen: customers' full names, shipping addresses, email addresses and phone numbers.

It was initially reported that around 14,000 people were affected, but a subsequent investigation uncovered another 67,000 affected customers in the US — bringing the final figure up to 81,000. The breach also affected buyers from Brazil, Colombia, Italy, Portugal, Sweden and the United Kingdom who had placed orders between May 10 and August 8, 2026. According to the notifications, the attackers exploited a vulnerability in the analytics platform Metabase — a critical zero-day SQL injection that Metabase's developers reported in early August. It is also known that after the hack, ShipMonk received ransom demand emails from the ShinyHunters group.

Even earlier, in January 2024, Trezor had already run into a compromise of a third-party service — its technical support portal, through which attackers reached the names, logins and email addresses of roughly 66,000 users.

The series of incidents is yet another reminder that even a securely protected hardware wallet is no safeguard against the risks that come through a company's contractors and communication channels.

Source: Bleeping Computer