Phishing attack targets Trezor users after breach

TLDR

A compromised third party email provider let attackers send highly convincing phishing emails to Trezor users, disguised as official critical security warnings.

1. Trezor confirmed its email provider was breached, enabling a fake Critical Security Alert: STM32 Entropy Vulnerability email sent from infrastructure that looked legitimately Trezor.
2. Current reports show no evidence that Trezor hardware, private keys, or recovery phrases were directly breached, but previous data leaks mean attackers can craft highly targeted scams.
3. Users should ignore that specific email subject, verify any security alerts via official channels, and never enter their recovery phrase into any website, app, or emailed form.

Deep Dive

1. What Happened In The Attack

Multiple reports state that attackers breached a third party email provider used by Trezor and sent a phishing email titled Critical Security Alert: STM32 Entropy Vulnerability to customers.

The email claimed up to 25 percent of devices had a serious randomness flaw and urged users to follow a security verification process via embedded links, according to coverage from outlets like Cointelegraph.

This campaign is unusually dangerous because the messages were sent via infrastructure authorized to send email on Trezors behalf, passing SPF, DKIM, and DMARC checks and appearing as coming from addresses such as [email protected] in some screenshots.

2. How Dangerous It Is For Users

Trezor and independent reports emphasize that wallet devices, private keys, and recovery phrases were not pulled from Trezor systems, and the attack vector is social engineering via email, not a direct on device exploit.

However, earlier breaches at logistics provider ShipMonk exposed data for more than 80,000 Trezor customers, including names and email addresses, which increases the quality of targeting for campaigns like this hardware wallet phishing wave.

The main risk is that a user, believing the message is legitimate, clicks the link and types their recovery phrase or signs malicious actions, which would give attackers full control of funds.

3. How To Stay Safe And What To Watch

For this incident, users should treat any email referencing STM32 Entropy Vulnerability as malicious and avoid clicking its links or opening attached offline HTML files that may secretly send data.

More broadly, users can reduce risk by:

1. Ignoring any email that asks for a recovery phrase or seed; legitimate hardware wallet vendors do not request this.
2. Verifying urgent alerts directly inside the wallet interface or via the vendors official website or app, not via emailed links.
3. Considering a dedicated email address for hardware wallets, so unexpected cross linking or new senders are easier to spot.

Because BitBox, Cointracking and others also reported phishing via a shared email provider, this looks like a broader campaign against Bitcoin and hardware wallet users, so further similar attempts are likely.

Conclusion

This incident is a reminder that the weakest link is often third party services and user inboxes, not the hardware wallet itself.

If users keep recovery phrases strictly offline and treat all emailed security alerts as suspicious until verified via official channels, attacks like this can be contained even when email infrastructure is breached.