Hackers hijack hardware wallet email alerts

TLDR

Hackers compromised email providers for several crypto services and used them to send fake hardware wallet security alerts that looked legitimate.

1. Attackers breached newsletter and email services used by Trezor, BitBox and Cointracking, sending phishing security alerts from real domains that passed normal email checks.
2. The emails falsely claimed critical hardware flaws or data breaches to trick users into entering recovery phrases or refreshing API keys, with no evidence that hardware wallets or private keys were directly hacked.
3. The safest response is to distrust urgent email alerts, verify any warning via official sites or apps, and never enter recovery phrases or keys into pages opened from unsolicited messages.

Deep Dive

1. How The Email Hijack Worked

Trezor, BitBox and Cointracking reported that hackers compromised their third party email or newsletter providers, then sent phishing campaigns through that infrastructure.

Because the emails used authorized domains and infrastructure, they appeared to come from addresses like [email protected] and passed SPF, DKIM and DMARC checks, making them hard to distinguish from genuine alerts.

Reports describe messages such as Critical Security Alert: STM32 Entropy Vulnerability and Data Breach Notice: Please refresh API Keys as soon as possible, sent via a shared marketing provider that services multiple crypto brands, including Brevo in Cointrackings case.

2. What The Phishing Messages Tried To Do

The fake Trezor alert claimed a hardware-level entropy flaw in STM32 microcontrollers and suggested up to 25 percent of devices were at risk, pushing users toward a security verification flow that could harvest recovery phrases or credentials.

For Cointracking, attackers posed as the service and told users to refresh API keys as soon as possible, which, if followed via the malicious link, would give attackers access to exchange-connected accounts.

So far, independent coverage notes no confirmed cases where the devices themselves were remotely exploited, and the primary risk is users voluntarily disclosing secrets through the phishing workflows rather than an on-device compromise.

3. Safer Ways To Handle Future Alerts

1. Treat any urgent email about a critical vulnerability or data breach as suspicious, even if it appears to come from an official address.
2. Instead of clicking email links, open the projects official site or app manually and check for the same alert on their status page, blog or in-app notifications.
3. Recovery phrases, private keys and long-lived API keys should never be entered into forms reached from unsolicited messages; manage them only inside trusted wallet or exchange interfaces you opened yourself.

Conclusion

This incident shows that attackers are pivoting from spoofed addresses to hijacking legitimate email infrastructure, turning trusted security alerts into phishing traps. For crypto users, the key defense is changing behavior, not just checking sender names - verify alerts through official channels you initiate and keep all wallet recovery information strictly offline and out of email.