BitBox reported a matching campaign the same day, weeks after a shipping provider breach exposed tens of thousands of Trezor customer records.
Trezor said its third-party email provider was breached, letting attackers send phishing emails from the company’s own domain. In an X post on Wednesday, Trezor told users that a message titled “Critical Security Alert: STM32 Entropy Vulnerability” did not come from the company and that they should not click any link in it.
Trezor said it has taken down the domain and is investigating how the attackers were able to send from its legitimate address. BitBox , the Swiss bitcoin hardware wallet maker, reported a similar campaign impersonating it the same day and told customers not to follow the instructions in the email. Marcello Paz , a crypto commentator who posts as MHPaz , shared screenshots of the message, which asked customers to update their devices because of a critical vulnerability said to affect newer hardware.
This story is an excerpt from the Unchained Daily .
The emails carried official domain names and signatures. Trezor’s standing advice through the recent incidents has not changed: never enter a wallet backup on a website or it with anyone.
The timing compounds an already bad month. Trezor disclosed on Aug. 13 that a breach at its shipping provider ShipMonk had exposed 13,689 customers, 11,742 of them with full details, on orders placed between May and August. Last week the company said another 67,000 U.S. customers were affected by the same breach, on orders going back to November 2019, with full names, shipping addresses, phone numbers and email addresses in the exposed records. Trezor has not published a combined figure, and the two disclosures could push the total above 80,000 .
Customer data leaks at wallet makers have long tails. Trezor’s support ticketing portal was breached in January 2024, putting 66,000 users at risk of phishing.
Related Listen: I Went Undercover to Interview a North Korean Crypto Hacker
AI-assisted content: This article was produced with the assistance of AI tools and was reviewed, edited, and fact-checked by a member of the Unchained editorial team before publication.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
