Trezor Says Third-Party Email Breach Let Attackers Send Phishing From Its Own Domain

BitBox reported a matching campaign the same day, weeks after a shipping provider breach exposed tens of thousands of Trezor customer records.

Phishing emails are coming from Trezor's real domain

Original Image Credits: Ira Lichi / Shutterstock.com

Posted September 10, 2026 at 6:11 am EST.

Trezor said its third-party email provider was breached, letting attackers send phishing emails from the company’s own domain. In an X post on Wednesday, Trezor told users that a message titled “Critical Security Alert: STM32 Entropy Vulnerability” did not come from the company and that they should not click any link in it.

Trezor said it has taken down the domain and is investigating how the attackers were able to send from its legitimate address. BitBox, the Swiss bitcoin hardware wallet maker, reported a similar campaign impersonating it the same day and told customers not to follow the instructions in the email. Marcello Paz, a crypto commentator who posts as MHPaz, shared screenshots of the message, which asked customers to update their devices because of a critical vulnerability said to affect newer hardware.

The emails carried official domain names and signatures. Trezor’s standing advice through the recent incidents has not changed: never enter a wallet backup on a website or share it with anyone.