Crypto news report · source clearly identified
Phishing Campaign Targets Trezor and BitBox Users with Fake STM32 Alert
Hardware‑wallet makers Trezor and BitBox warned users on Sept. 9 about phishing emails impersonating their brands, citing a breach of a third‑party email provider and a likely compromise of a newsletter service.
On Sept. 9, both Trezor and BitBox issued alerts about phishing emails that pretended to be official security notices. The messages used a technical subject line – “Critical Security Alert: STM32 Entropy Vulnerability” – to lure recipients into clicking malicious links.
What happened
Trezor identified the email as a phishing attempt and confirmed that its third‑party email provider had been breached. The company removed the fraudulent domain and began investigating the breach, but reiterated on Sept. 10 that its hardware wallets remain secure.
BitBox issued a similar warning, stating that its preliminary review indicated a likely compromise of its newsletter provider. The company noted that other Bitcoin‑related firms using the same provider were also targeted.
Company responses
- Trezor: Took down the phishing domain, investigated the provider breach, and assured users that wallet funds are safe.
- BitBox: Warned subscribers, contacted the newsletter provider, reported the phishing domains, and continued its investigation.
Recommended user actions
- Ignore any instructions or links in the suspicious emails.
- Never share recovery seeds or backup phrases.
- Verify any security concerns through official channels, not through links in the email.
- Download wallet software only from the official website.
Source & attribution
News Source
- Publisher
- CryptoSlate
- Original date
- September 11, 2026, 8:10 AM
- Original headline
- Attackers exploit fake STM32 vulnerability alert to target Trezor and BitBox holders