Nikolas Sargeant
TL;DR
-
Trezor says attackers breached a third-party email provider and sent phishing messages from its official domain.
-
The fraudulent alert instructed users to update their wallets because of a supposed vulnerability. Trezor has taken the domain offline and is investigating the breach.
Hardware wallet manufacturer Trezor has disclosed a breach involving a third-party email provider that allowed attackers to send phishing messages from the company’s official domain.
Trezor warned customers Wednesday about an email titled “Critical Security Alert: STM32 Entropy Vulnerability,” stressing that the message was fraudulent and urging recipients not to click any links.
Our third-party e-mail provider has been breached. Please be aware that the email named ‘Critical Security Alert: STM32 Entropy Vulnerability’ is not coming from us, and it’s a phishing attempt. Do not click on any link.
— Trezor (@Trezor) September 9, 2026
We have taken down the domain, and we are investigating…
The company has since taken the affected domain offline and opened an investigation into the incident, including how the attackers gained the ability to distribute messages using its legitimate domain.
Phishing Email Urged Users to Update Their Wallets
The malicious email claimed that a critical vulnerability could affect newer Trezor devices and instructed customers to update their hardware wallets.
Crypto commentator Marcello Paz shared screenshots of the message, showing that it contained official-looking domain credentials and signatures. Those features made the campaign potentially more convincing than conventional phishing attacks, which typically rely on misspelled or imitation email addresses.
The attack poses a significant risk because hardware wallet phishing campaigns often attempt to steal seed phrases or persuade users to install malicious software. Trezor has repeatedly emphasized that customers should never disclose their wallet recovery seeds.
Swiss Bitcoin hardware wallet company BitBox reported a similar phishing email circulating under its name on the same day.
The latest security issue comes shortly after Trezor disclosed a substantial breach at ShipMonk, one of its shipping providers.
Trezor initially said the incident exposed names, cities, and email addresses belonging to approximately 13,700 customers. The company later revealed that another 67,000 customers in the United States had also been affected.
Although those incidents did not directly compromise hardware wallets, leaked contact information can help criminals create more targeted and believable phishing campaigns.
Hardware Wallet Companies Face Persistent Threats
Trezor has also faced scrutiny over hardware security. In June, Ledger’s Donjon research team disclosed a vulnerability in the TROPIC01 chip used in the Trezor Safe 7.
Researchers demonstrated a laboratory-based laser attack capable of bypassing the chip’s firmware verification system. Trezor said no customer funds were at risk.
Hardware wallet users have long been targets of social-engineering attacks. A 2020 Ledger breach exposed information belonging to more than 270,000 customers, including names, emails, phone numbers, and some home addresses. Some affected customers continued to receive fraudulent calls and physical letters years later.
