Trezor Hit by Third Vendor Breach as Hackers Send Legit-Looking Emails
Hardware wallet maker Trezor has warned users that attackers compromised a third-party email provider and used legitimate Trezor infrastructure to distribute a fake security alert.
Summary:
- Attackers used Trezor’s legitimate email infrastructure to distribute phishing messages.
- The fake alert exploits fears surrounding recovery-phrase generation and entropy.
- Trezor says its hardware wallets are not affected by the claimed vulnerability.
The phishing message claims an “STM32 Entropy Vulnerability” threatens wallet recovery phrases and directs recipients toward a malicious process. Trezor confirmed in X, that the warning is fraudulent, took the affected domain offline and is investigating how attackers gained access. The incident adds to a difficult month for the company, during which separate third-party security failures have exposed customer information and created new opportunities for targeted phishing.
Our third-party e-mail provider has been breached. Please be aware that the email named ‘Critical Security Alert: STM32 Entropy Vulnerability’ is not coming from us, and it’s a phishing attempt. Do not click on any link.
We have taken down the domain, and we are investigating…
— Trezor (@Trezor) September 9, 2026
Authentication Checks Passed, Making the Phishing Harder to Spot
The latest campaign undermines one of the most common defenses against phishing: checking who actually sent the message.
Reports from recipients showed the fraudulent emails passing authentication checks including SPF, DKIM and DMARC. The messages appeared to originate through infrastructure associated with Trezor rather than from a simple lookalike domain. Trezor subsequently confirmed that a third-party email provider had been breached and said it was investigating how the attackers obtained access to its legitimate domain.
That gives the campaign considerably more credibility than conventional email spoofing.
The fake message tells recipients that a hardware-level flaw involving STM32 microcontrollers could reduce the randomness used when wallets generate recovery information. It then pushes users toward a supposed security procedure.
Trezor says no such vulnerability affects wallets generated on its devices. The company had already addressed similar entropy concerns in August when a genuine vulnerability affected certain Coldcard firmware versions, explicitly stating that Trezor-generated wallets were not affected.
The attackers are therefore borrowing a real crypto-security concept and applying it to a nonexistent Trezor flaw.
Why an Entropy Warning Is Effective Phishing Bait
Entropy is central to how cryptocurrency wallets generate secrets.
When a new wallet is created, sufficient randomness is required so that its private keys and recovery phrase cannot realistically be predicted. A genuine failure in that process can be serious because an attacker may be able to reconstruct wallet credentials without physically possessing the device.
That makes an alleged entropy vulnerability unusually effective social-engineering material. A recipient does not simply see a generic warning that an account has been compromised. They are told that the cryptographic foundation protecting their wallet may be defective.
The natural response is to secure the wallet quickly.
That urgency is what the attacker needs.
One Trezor forum user who analyzed the campaign reported that a downloaded HTML file was designed to capture recovery information and transmit it to attackers. Other recipients reported being directed toward processes requesting sensitive wallet data.
A recovery phrase is fundamentally different from a password that can be reset after a breach. Anyone who obtains it can recreate the wallet elsewhere and potentially control its assets.
Trezor’s Hardware Is Not the Compromised Component
Nothing disclosed about the latest incident indicates that attackers broke into Trezor devices or defeated their cryptographic protections.
The compromised component was an external communication service.
That distinction is important because a hardware wallet’s main security function is to isolate private keys from internet-connected devices. An attacker attempting to steal cryptocurrency remotely therefore faces a much harder problem if the signing key remains protected inside the wallet.
Phishing changes the attack model.
Instead of extracting the key technically, the attacker attempts to persuade its owner to reveal the backup that can recreate it.
The latest campaign demonstrates how much more convincing that approach becomes when criminals gain control over infrastructure users normally rely on to determine whether a message is authentic.
ShipMonk Breach Exposed Data on More Than 80,000 Customers
The email incident follows a separate breach involving Trezor shipping provider ShipMonk.
Trezor initially disclosed in August that unauthorized access to ShipMonk systems exposed customer order information. The company later expanded the scope after learning that historical records from an earlier period had remained stored despite assurances that the information had been deleted.
The additional exposure affected approximately 67,000 U.S. customers who ordered between November 2019 and August 2021.
Combined with the customers identified in the original disclosure, the breach affected 80,689 people.
For many of those customers, the exposed information included names, email addresses, phone numbers, shipping addresses and order numbers.
READ MORE: Crypto Security Under Pressure: Three Incidents Raise New Risks
No private keys or wallet backups were part of the ShipMonk dataset identified by Trezor, and the company’s devices were not compromised. But the information has value for a different reason: it can tell an attacker who owns a hardware wallet and how to contact them.
Trezor warned that the leaked information could support fraudulent emails, phone calls and physical letters, while exposure of home addresses could also create physical-security risks.
Vendor Security Is Becoming Part of Hardware Wallet Security
Taken individually, a compromised mailing service and a breached logistics provider are different security events. There is currently no evidence that the attackers behind them are connected.
For customers, however, the risk can compound.
A logistics database may identify someone as a hardware-wallet buyer. A compromised communication platform can give an attacker a trusted-looking channel through which to approach that person. Neither requires breaking the wallet itself.
This creates an uncomfortable security problem for hardware-wallet companies.
Self-custody is built around reducing dependence on trusted intermediaries for control of crypto assets. Yet buying and using a hardware wallet can still involve shipping companies, customer-support systems, email platforms and other vendors that collect information around the owner.
The cryptographic perimeter may therefore be considerably smaller than the customer-data perimeter.
That does not make cold storage ineffective. It means operational privacy and social-engineering resistance become part of the security model once attackers cannot easily reach the private key directly.
What Trezor Users Can Do Now
The immediate response does not require moving funds simply because the phishing email was received. Trezor says the claimed STM32 vulnerability is not genuine, and its earlier technical guidance states that wallets originally generated on Trezor are not affected by the Coldcard entropy flaw.
Users can instead reduce their exposure to the attack by following several basic rules:
- Never type a recovery phrase into a website. A request to enter wallet backup words online should be treated as malicious regardless of how convincing the email or website appears.
- Do not trust the sender address alone. The current incident demonstrates that a legitimate-looking domain is not sufficient evidence that a security message is genuine.
- Open Trezor services independently. Instead of following links in unexpected security emails, navigate directly to Trezor’s official website or open Trezor Suite yourself.
- Verify urgent security notices through a second channel. Check official Trezor announcements and support information before acting on claims about firmware, wallet migrations or vulnerabilities.
- Be cautious with personalized messages. Customers affected by the ShipMonk breach should assume that scammers may know their name, email address, phone number, shipping address or previous Trezor order details.
- Treat physical privacy seriously. Customers whose home addresses were exposed should be particularly suspicious of unexpected letters, packages, calls or other communications referring to their hardware wallet.
The information presented in this article is intended for informational purposes only and should not be interpreted as financial, investment, or trading advice. Coinspress.com does not promote or advocate for any particular investment strategy, asset, or cryptocurrency project. Cryptocurrency markets are highly volatile and unpredictable – always perform your own research and seek guidance from a qualified financial professional before making any investment decisions.
Alexander Zdravkov
Reporter at CoinsPress
Alexander Zdravkov is a market analyst and crypto journalist with interests in economics, broader financial markets and digital assets. His journey into crypto began more than four years ago, driven by a fascination with the rapid evolution of blockchain technology and the transformative potential of decentralized finance. He began analyzing market cycles and identifying emerging trends before they reach the mainstream. He holds a degree in International Relations - a background that helped shape his broader perspective on global economics, geopolitics, and the interconnected nature of modern financial markets. Whether covering the latest developments in the crypto sector or exploring broader macroeconomic themes, Alexander focuses on giving readers context rather than simply repeating headlines. During his career, he has authored more than 10,000 articles covering cryptocurrencies, traditional finance, and global market developments. His work spans everything from Bitcoin and altcoins to macroeconomic trends influencing risk assets worldwide.
