Phishing Attack Targets Trezor and BitBox Users via Compromised Email Provider

• •Phishing emails exploited a legitimate email provider breach, appearing authentic.
• •Trezor and BitBox users were targeted with false claims of critical hardware vulnerabilities.
• •The incident highlights risks associated with third-party email services in the crypto sector.

On September 9, 2026, Trezor and BitBox users received phishing emails titled 'Critical Security Alert: STM32 Entropy Vulnerability,' claiming a serious flaw in their hardware wallets. The emails were sent through a legitimate third-party email provider that was breached, making them appear authentic and bypassing usual security checks. Trezor confirmed the breach and advised users not to click on any links. The phishing campaign exploited fears related to hardware vulnerabilities, falsely claiming that one in four devices were affected. The incident has raised concerns about the security of third-party email services used by cryptocurrency companies. Trezor has taken down the compromised domain and is investigating the breach. Similar phishing attempts were reported targeting BitBox users, indicating a coordinated attack across multiple companies. The exact number of affected users remains undisclosed.