Wallet email hacks target global crypto users

TLDR

Attackers have compromised email providers for major crypto wallet services, sending very convincing phishing emails that look like real security alerts.

1. Hardware wallet brands like Trezor and BitBox report breached third-party email services that sent fake security alert messages from legitimate domains.
2. The campaigns can affect tens of thousands of users and mainly aim to steal seed phrases or API keys, not to break the wallets cryptography directly.
3. Crypto users should treat all email alerts as suspicious, verify notices through official channels, and never enter recovery phrases or keys via links in messages.

Deep Dive

1. How The Attacks Work

Recent reports show that attackers hijacked mailing infrastructure used by Trezor, BitBox and Cointracking, letting them send phishing emails from domains that email providers already trust as legitimate security notices, not spam. These emails include subjects like Critical Security Alert: STM32 Entropy Vulnerability and Data Breach Notice: Please refresh API Keys as soon as possible, and were sent after third-party providers such as Brevo and other newsletter services were breached, according to multiple outlets covering the compromised hardware wallet emails.

Unlike typical scams with misspelled domains, some of these messages passed SPF, DKIM and DMARC checks and appeared to come from real support addresses, which makes them much harder for users and spam filters to spot.

2. Who Is At Risk And What Is Compromised

Trezor has separately disclosed that data breaches at logistics provider ShipMonk exposed contact and delivery information for more than 80,000 US customers, increasing the pool of people who can be targeted with tailored phishing emails that reference real orders and addresses, as noted in coverage of the ShipMonk customer data breach.

Critically, hardware wallet manufacturers report that seed phrases and on-device private keys remain secure, and there is no evidence that the wallet chips were compromised by these email incidents. The main risk is social engineering: anyone who follows a link and types their recovery phrase, exchange API keys or login credentials into a fake page can have their funds drained.

3. Practical Defenses For Crypto Users

To reduce risk, treat every urgent wallet or exchange email as untrusted until you confirm it through a separate route. Manually visit the official website or app, or check the projects verified social account for matching security announcements, instead of clicking embedded links.

Never enter your seed phrase, private key or full API key into a web form; recovery phrases should only ever be used inside the wallets official interface or recovery process, and ideally stay offline. For exchanges and tracking tools, keep strong unique passwords and two-factor authentication enabled, so stolen email access alone cannot move funds.

Confidence: high because multiple wallet vendors and independent media confirm the email compromises and phishing details.

Conclusion

This wave of wallet-related email hacks shows that attackers are focusing on trusted communication channels rather than breaking cryptography, using breached marketing and logistics providers to reach many users at once. If you treat all emails as potentially hostile and only trust messages that match independent checks on official sites or apps, you can keep using hardware wallets and exchanges while sharply reducing the chance that one convincing email turns into a catastrophic loss.