GoKawiilTrezor's email vendor breached, used to send fake security-alert phishing emails
Trezor alerted customers that attackers compromised its third-party email provider and used the legitimate [email protected] address to send phishing emails warning of a fake 'STM32 Entropy Vulnerability' in its hardware wallets. The company took down the malicious domain and is investigating how attackers gained access to its email infrastructure. This follows an earlier breach disclosed in August involving shipping partner ShipMonk, which exposed personal data of roughly 81,000 customers across multiple countries.
GoKawiil's interpretation of the reporting above, not reported fact.
Because the phishing emails came from Trezor's real domain, they were far more convincing than typical scam attempts, putting cryptocurrency holders at heightened risk of being tricked into exposing wallet seeds. The incident, layered on top of the earlier ShipMonk breach, highlights how third-party vendor compromises can undermine trust in security-focused hardware companies even when their core products remain unaffected.
- Attackers breached Trezor's email provider to send phishing messages from its legitimate domain.
- The fake emails cited a bogus STM32 microcontroller vulnerability to scare users into clicking malicious links.
- This follows an August ShipMonk breach that exposed data of about 81,000 Trezor customers worldwide.
Trezor Safe 5 Hardware Wallet — If you're following the phishing warnings, buying a hardware wallet directly from the official Trezor listing is the safest route — and the Safe 5 keeps your seed offline where email scams can't reach it. Its color touchscreen lets you confirm every transaction on the device itself, so a fake "critical security alert" link can't move your funds.
See Trezor Safe 5 Hardware Wallet on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-09-10
Published there as: “Trezor warns users of email provider breach, phishing attacks”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.