Trezor confirmed that a third-party email provider suffered a security breach, allowing attackers to send phishing emails to customers. The fraudulent messages, titled Critical Security Alert: STM32 Entropy Vulnerability, falsely claimed that a hardware flaw affected recovery phrases on one in four devices.
The company stated that it has disabled the malicious domain used in the attack and is currently investigating how unauthorized access was obtained. Trezor warned users not to click any links in the emails, noting that no such security advisory was issued by their engineering team.
Security researchers, including Casa CSO Jameson Lopp, suggest the campaign may be broader, as similar phishing attempts were reported by BitBox users. Experts believe a marketing email service provider may have been compromised, potentially impacting multiple hardware wallet manufacturers.
This incident follows a separate data breach in August involving shipping provider ShipMonk, which exposed the personal information of 80 689 Trezor customers. That leak included names, phone numbers, and physical addresses, which could facilitate more targeted phishing attacks.
