Hardware wallet maker Trezor warned users Wednesday that hackers breached its third-party email provider and used it to distribute a phishing email disguised as a critical security warning.
The fraudulent email, titled "Critical Security Alert: STM32 Entropy Vulnerability," falsely claimed that Trezor engineers discovered a critical hardware-level vulnerability in STM32 microcontrollers used in its devices. The message alleged the defect affected approximately one in four devices and could compromise the randomness of recovery phrases.
Trezor issued a statement on X warning users not to click any links in the email. The company said it took down the domain used in the attack and is investigating how attackers gained access to its legitimate domain.
Security researchers suggested the breach may extend beyond Trezor. Casa co-founder and CEO Nick Neuman noted that BitBox users reported receiving similar phishing emails, indicating a marketing email provider may have been compromised. Bitcoin security researcher and Casa Chief Security Officer Jameson Lopp posted that threat actors may have compromised email providers used by both Trezor and BitBox.
In August, Trezor reported that a breach at shipping provider ShipMonk exposed customer data belonging to 80,689 people, including names, email addresses, phone numbers, and shipping addresses. The company warned that the leaked information could be used in more sophisticated phishing attacks.
