Trezor users face phishing attack after breach

TLDR

Trezor has confirmed that attackers breached a third?party email provider and sent highly realistic phishing emails from its legitimate domain.

1. The phishing emails impersonate a critical security alert and follow earlier vendor data leaks affecting over 80,000 Trezor customers.
2. Trezor says hardware wallets, private keys, and seed phrases are not directly compromised, but exposed personal data makes targeted scams more dangerous.
3. Users should treat any security alert email with suspicion, verify via official channels, and never enter recovery phrases into links or forms.

Confidence: high because multiple independent reports and Trezors own notices align on the incident details.

Deep Dive

1. What Happened In The Latest Attack

Trezor disclosed that hackers compromised an external email service, allowing phishing emails to be sent from infrastructure authorized to use its domain, including mailing.trezor.io and trezor.io itself.a third party email provider breach

The fraudulent messages carried the subject Critical Security Alert: STM32 Entropy Vulnerability and falsely claimed that a flaw in STM32 chips made recovery phrases unsafe, urging users to perform urgent security steps via embedded links.emails titled "Critical Security Alert: STM32 Entropy Vulnerability"

Because the emails passed standard SPF, DKIM, and DMARC checks, they looked authentic both to users and spam filters, significantly raising the risk that recipients would trust and act on them.

2. How Much User Risk This Creates

Separately, Trezors shipping partner ShipMonk suffered a breach that exposed names, emails, phone numbers, shipping addresses, and order numbers for more than 80,000 customers, increasing the pool of people who can now be targeted credibly.personal data of about 80,689 customers

Across both incidents, Trezor and multiple reports emphasize that wallet devices, private keys, and seed phrases were not accessed directly; the threat is phishing and social engineering that tricks users into handing over secrets.

Risk note: leaked names and addresses can enable highly personalized emails, calls, and even physical letters that appear to know your hardware wallet history.

3. Practical Safety Steps For Hardware Wallet Users

1. Never enter your recovery phrase on any website or in response to an email; hardware wallet vendors repeatedly state they will not ask for it via email or chat.
2. For any security alert, go directly to the official site or app and check announcements there instead of clicking email links.
3. Be cautious of calls, texts, or physical letters referencing real order details, as breached records can be used to impersonate support.

Conclusion

The Trezor incidents show that even when hardware and keys remain technically secure, weak points in vendor logistics and email infrastructure can sharply increase phishing risk. For crypto users, the safest posture is to treat every urgent security message as suspect, verify independently, and keep recovery phrases strictly offline and under your control.