Hardware wallet makers Trezor and BitBox issued warnings on September 9 about phishing emails impersonating their brands. The companies urged recipients to avoid clicking links or following instructions in the fraudulent messages.
Trezor identified a phishing email with the subject line "Critical Security Alert: STM32 Entropy Vulnerability" as a fake security alert. The company confirmed on September 10 that a third-party email provider had been breached and that it had taken down the fraudulent domain. Trezor reiterated that its wallets remained secure despite the incident.
BitBox issued a similar warning the same day, stating that a preliminary review indicated its newsletter provider had likely been compromised. BitBox noted that other Bitcoin companies appeared to share the same newsletter provider and had also been targeted. The company said it had warned all newsletter subscribers, contacted the provider, and reported the phishing domains. Most phishing links had been taken down at the time of BitBox's update, though its investigation continued.
Protecting Recovery Seeds
Both companies emphasized that users should keep their recovery seeds—wallet backups that grant access to funds—private. According to Trezor's security guidance, anyone with access to a recovery seed can move the funds associated with that wallet, making phishing instructions dangerous even when wallet security remains intact.
Users who received suspicious emails should ignore the messages and verify any follow-up through the official websites and communication channels of Trezor and BitBox rather than through links provided in the emails.
