Trezor Reports Another Security Incident

Trezor disclosed that attackers compromised its third‑party email provider and used the breach to send phishing emails to customers. The messages were disguised as a critical security alert about an alleged “STM32 Entropy Vulnerability” in Trezor devices.

Background of Recent Vendor Failures

This is the third vendor‑related incident for Trezor within a month. Earlier, a breach at ShipMonk – the logistics partner that ships Trezor orders – exposed personal data of more than 80,000 customers, including names, phone numbers and home addresses. In 2024, a support portal breach affected about 66,000 users. Similar incidents have been reported by other hardware wallet manufacturers, such as SafePal and BitBox.

How the Phishing Email Was Crafted

The fraudulent email referenced an “STM32 Entropy Vulnerability.” STM32 is the family of micro‑chips used in Trezor devices, and entropy refers to the randomness needed to generate recovery phrases. By invoking a potential weakness in this core component, the email appeared credible to owners concerned about the security of their wallets.

What Users Should Do

• Do not click any links in unexpected emails claiming to be from Trezor, especially those mentioning STM32 or entropy.
• Never enter a recovery phrase or device passcode on a website.
• Treat unsolicited phone calls or physical letters as potentially hostile until verified.
• Verify official communications by checking the trezor.io website or the verified Trezor account on X.
• If a recovery phrase was entered on a suspicious page, move funds to a new wallet.

Wider Impact on the Hardware Wallet Ecosystem

BitBox, another Bitcoin hardware wallet maker, reported a similar phishing campaign targeting its newsletter subscribers, suggesting that multiple companies may share the same compromised email service provider. Users of other Bitcoin‑related services have also reported scam calls and printed letters following the breach.