Trezor phishing attack targets hardware wallet users

TLDR

Trezor hardware wallet users are being targeted by a highly convincing phishing campaign that uses real-looking security emails sent via a breached third-party email provider.

1. Attackers breached Trezors email provider and sent fake Critical Security Alert: STM32 Entropy Vulnerability messages from what appears to be Trezors own domain.
2. The emails falsely claim up to 25 percent of devices are vulnerable and push users to click links or run updates, which can steal recovery phrases and drain funds.
3. Hardware wallets and private keys remain uncompromised; the real risk is users falling for the scam, so the key defense is never entering a seed phrase or signing from untrusted prompts.

Deep Dive

1. How The Attack Works

Trezor confirmed that a third-party email provider was breached, allowing attackers to send phishing emails from infrastructure authorized to send on its behalf. These emails passed SPF, DKIM and DMARC checks, so they look legitimate in inboxes, including headers like mailed-by: mailing.trezor.io and signed-by: trezor.io as reported by security writeups.

The fraudulent message, titled Critical Security Alert: STM32 Entropy Vulnerability, claims a severe flaw in STM32 microcontrollers and says around one in four devices may be affected, urging users to perform a security verification via a link or offline HTML file. This mirrors reports that hackers sent phishing emails from Trezors domain after the provider breach.

2. Who Is Affected And What Is At Risk

Trezor says its own systems and wallets are not breached and that devices, private keys and recovery phrases remain secure on the hardware. The attack instead targets users directly by tricking them into revealing their seed or interacting with malicious software.

The campaign appears broader than Trezor alone. BitBox and Cointracking have also warned that their users received similar fake security or data breach emails via shared newsletter infrastructure, and one provider has been named in reports as the common email service.

Previous incidents, such as Trezors shipping partner ShipMonk leaking data for over 80,000 customers, increase the pool of known hardware wallet owners that scammers can target with personalized messages.

3. How Hardware Wallet Users Can Stay Safe

In practical terms, this attack only succeeds if a user follows the phishing instructions. You can break the chain of attack by:

1. Ignoring and deleting any Critical Security Alert: STM32 Entropy Vulnerability email and similar urgent security notices that arrive via email.
2. Never entering your recovery phrase into a website, app, email form or PDF, and never sharing it with support staff of any company.
3. Verifying updates only from the official site or app that you navigate to yourself, or from announcements you see on Trezors official channels, such as the warning referenced in this breach-related notice.

If any message tells you to verify your wallet, reenter your seed or update due to critical entropy issues, treat it as malicious, even if the email address looks correct.

Confidence: high, because multiple independent news and company statements describe the same subject line, attack method and mitigations.

Conclusion

This phishing campaign does not compromise Trezor devices themselves. It exploits trust in official-looking emails and fear of security flaws to trick users into handing over recovery phrases or signing malicious actions. For hardware wallet owners, the strongest defense is strict hygiene around seed phrases, links and software updates, and treating every unsolicited critical security alert as suspect until independently verified via official channels.