Hardware wallet manufacturers Trezor and BitBox have issued warnings to users regarding phishing emails disguised as urgent security notices. The alerts follow suspected security compromises involving third-party email service providers.
On Wednesday, Trezor stated that its email provider had experienced a breach. The company warned users about a fraudulent message carrying the title “Critical Security Alert: STM32 Entropy Vulnerability” and urged recipients to avoid clicking any links contained within the email.
On the same day, BitBox issued a similar warning about a phishing email impersonating the company. According to a preliminary review by BitBox, its newsletter provider was likely compromised. The company noted that multiple Bitcoin companies appeared to have been targeted through a shared provider.
These warnings arrive amid several recent security disclosures within the hardware-wallet sector. Trezor previously disclosed data breaches involving its shipping provider, ShipMonk, which affected nearly 14,000 customers on Aug. 13 and an additional 67,000 US customers on Sept. 4.
Meanwhile, BitBox addressed security items earlier this year, stating in July that its devices were unaffected by a vulnerability related to Coldcard’s random-number generation. In August, BitBox released an update to address two severe firmware vulnerabilities, though no known exploitation or stolen funds were reported at the time.
