TLDR
Hackers compromised a third-party email provider used by Trezor, letting them send highly convincing phishing emails from Trezors legitimate domain.
- Trezor, BitBox and Cointracking reported that attackers used breached newsletter/email infrastructure to send fake Critical Security Alert: STM32 Entropy Vulnerability messages from real-looking addresses.
- The attack targets users recovery phrases and credentials via a fake security update flow, while current reports indicate no direct compromise of hardware wallets, private keys or on-device firmware.
- Users need to treat all security alert emails as suspect, verify notices via official apps or websites, and never enter recovery phrases or API keys into links received by email.
Deep Dive
1. What Happened To Trezor Emails
Trezor reported that a third-party email provider it relies on was breached, allowing attackers to send phishing emails from infrastructure authorized to use the trezor.io domain, including addresses like [email protected] and mailing.trezor.io.
The fraudulent emails carried the subject Critical Security Alert: STM32 Entropy Vulnerability and claimed up to 25 percent of devices were at risk, closely mimicking a genuine security notice from the company.
Other crypto firms, including BitBox and Cointracking, reported similar phishing waves tied to a shared newsletter provider, with Cointracking naming Brevo as its affected vendor, in what appears to be a multi-company incident involving shared email infrastructure.
Even SPF, DKIM and DMARC passed emails can be malicious if an email provider is compromised, so relying only on green security ticks in your inbox is no longer enough.
2. What Is At Risk For Users
The malicious emails appear designed to funnel users into a fake verification or update process, including HTML files capable of sending entered information to channels such as Telegram, which could expose recovery phrases or other sensitive data.
Current reporting and company statements emphasize that the breach sits at the email / marketing layer, not inside hardware wallets themselves; there is no evidence so far that Trezor, BitBox or Cointracking devices, seeds or on-device secrets were directly compromised.
This campaign lands shortly after Trezors logistics partner ShipMonk exposed data for over 80,000 customers, increasing the pool of real names, emails and addresses attackers can use to craft very believable messages that reference genuine orders or locations.
3. How To Handle These Phishing Risks
In this environment, safer practice is to distrust any unsolicited critical security alert email, especially those urging urgent action, and instead check directly inside the official wallet app or via the vendors bookmarked website.
Vendors repeatedly state they will never ask for your recovery phrase or full seed via email, web forms reached from unsolicited links, or support chat, so any such request is a strong red flag regardless of how authentic the sender looks.
Going forward, users should watch for further advisories from Trezor and other affected firms, as investigations into the shared email provider continue and additional companies or campaigns may still surface.
Conclusion
This incident is a reminder that even hardware wallet setups can be undermined at the human layer when attackers hijack trusted communication channels. The core risk here is social engineering that tricks users into revealing recovery data, not a cryptographic break of the devices themselves. Staying safe means assuming email can be forged, verifying alerts through official channels you initiate yourself, and keeping recovery phrases permanently offline.
CoinsKid.Com