Bitcoin Wallet Maker Trezor Says Hackers Breached Its Email Provider

In brief

• Trezor said its third-party email provider was breached and used to send phishing emails.
• The fake alert claimed an STM32 hardware flaw weakened recovery phrases on some Trezor devices.
• Security researchers said similar emails targeting BitBox users may point to a broader compromise of hardware-wallet email providers.

Hardware wallet maker Trezor warned users Wednesday that hackers breached its third-party email provider and used it to distribute a phishing email disguised as a critical security warning.

“Please be aware that the email named ‘Critical Security Alert: STM32 Entropy Vulnerability’ is not coming from us, and it’s a phishing attempt. Do not click on any link,” Trezor wrote on X.

Trezor said it took down the domain used in the attack and is investigating how hackers gained access to its legitimate domain.

The fake Trezor email claims the company's engineers discovered a “critical hardware-level vulnerability” in STM32 microcontrollers used in its devices. It then falsely claims the defect affects an estimated one in four devices and could leave recovery phrases with insufficient randomness, or entropy, likely playing on fears related to the recent Coldcard exploit that cost users over $130 million in Bitcoin.