Trezor and Bitbox users face phishing campaign

TLDR

Trezor and BitBox hardware wallet users are being hit by phishing emails that look like urgent security alerts from the companies themselves.

1. Hackers breached third-party email and newsletter providers and sent emails like Critical Security Alert: STM32 Entropy Vulnerability that appear to come from Trezor and other firms.
2. Current reports say hardware wallets, private keys, and recovery phrases are not directly compromised, but users who follow the fake instructions risk handing attackers full control of their funds.
3. Users should treat any urgent email as suspect, avoid clicking embedded links, and verify alerts directly via official apps or sites before taking action.

Deep Dive

1. How The Phishing Campaign Works

Multiple reports say attackers compromised third party email or newsletter infrastructure used by Trezor, BitBox and Cointracking, then sent phishing emails that passed normal authenticity checks.

Trezor warned that a message titled Critical Security Alert: STM32 Entropy Vulnerability was fraudulent and resulted from a breach of its email provider, yet still appeared to come from its legitimate domain and passed SPF, DKIM and DMARC checks. This is described in detail in coverage of the fake hardware wallet security alerts.

BitBox reported a similar pattern and said its newsletter provider was likely compromised, with several Bitcoin companies targeted through the same provider. Other coverage links Cointrackings incident to a provider identified as Brevo, showing this is a coordinated campaign across multiple brands.

2. Are Devices Or Funds Compromised

In these incidents, the compromise is in the email infrastructure, not in the Trezor or BitBox hardware itself. The devices, firmware, and on-device key storage are reported as unaffected.

The real danger is social engineering. The phishing emails claim a critical vulnerability and push users to verify or update via links, which can lead to fake sites that capture recovery phrases, passwords, or API keys. Once a recovery phrase is exposed, attackers can rebuild the wallet and drain funds.

3. Practical Steps And What To Watch

1. Ignore and delete any Critical Security Alert: STM32 Entropy Vulnerability email or similar urgent security notice that asks you to click a link.
2. Assume any email asking for your recovery phrase, private key, or to verify seed or keys is a scam. Hardware wallet makers repeatedly state they will never ask for these via email.
3. For any genuine concerns, open the official app or type the official website URL manually, then check for alerts in the product itself or via their verified announcement channels.

Confidence: high because multiple independent news outlets and company statements describe the same campaign and technical pattern.

Conclusion

A shared third party email breach has turned genuine looking security alerts into a phishing channel for Trezor and BitBox users, but the hardware wallets themselves are not reported as compromised.

The core risk is users being tricked into revealing recovery phrases or credentials, so the most important defense is strict discipline about never following unsolicited links or sharing secrets outside official, verified channels.