Trezor confirmed a security breach at its third-party email provider, resulting in phishing emails sent to customers. The messages falsely claimed to be a critical security alert regarding an STM32 entropy vulnerability. The company stated that hardware wallets, private keys, and recovery backups remain secure, as the incident was limited to the email service.
This event marks the third vendor failure for Trezor in four weeks. Previously, a breach at the logistics partner ShipMonk, reported on August 10 and updated on September 4, exposed contact details for over 80 000 customers, including names, phone numbers, and home addresses. These leaks have led to reports of scam calls and physical mail targeting users.
The company has disabled the malicious domain and is currently investigating the breach. Trezor advises users to ignore unexpected emails, avoid clicking suspicious links, and never enter recovery phrases on websites. Users who may have compromised their recovery seeds are urged to transfer funds to a new wallet immediately.
The phishing campaign also affected other industry players. BitBox reported a similar incident, noting that their newsletter provider was likely compromised. BitBox indicated that multiple Bitcoin companies sharing the same service provider were targeted in these attacks. Trezor previously warned 66 000 users of a support portal breach earlier in 2024.
