PRAGUE, September 11 — Trezor has warned customers that threat actors who breached its third-party email provider are now targeting them in phishing attacks, the latest in a run of third-party security failures at the cryptocurrency hardware wallet maker. Affected customers received fake “critical security alert” emails sent from [email protected], claiming that a “hardware microcontroller vulnerability” in the STM32 microcontrollers used by Trezor cold storage wallets could expose their seeds to brute-force cracking.
Trezor said it is investigating the breach and that the domain has been taken down to stop the attacks. “Our third-party e-mail provider has been breached.
Please be aware that the email named ‘Critical Security Alert: STM32 Entropy Vulnerability’ is not coming from us, and it’s a phishing attempt. Do not click on any link,” Trezor warned. “We have taken down the domain, and we are investigating the situation, including how the hackers got access to our legit domain.”
A pattern of third-party exposure
The phishing campaign follows a separate data breach Trezor disclosed in August after attackers hacked ShipMonk, its shipping and logistics provider, and stole customers’ order data, including full names, shipping addresses, email addresses, and phone numbers. The company initially said the incident affected nearly 14,000 customers, but a Friday update warned that a follow-up investigation found the breach affected an additional 67,000 U.S. customers, bringing the total to 81,000.
Trezor said the data breach also impacted customers in Brazil, Colombia, Italy, Portugal, Sweden, and the United Kingdom who received orders between May 10 and August 8, 2026. While Trezor did not say how ShipMonk’s systems were breached, breach notification emails seen by BleepingComputer said the attackers exploited a vulnerability in the Metabase analytics platform.
In early August, Metabase said threat actors exploited a critical SQL injection zero-day vulnerability to breach customer instances, gain administrator access, and steal data. BleepingComputer also learned that ShipMonk received extortion emails from the ShinyHunters extortion gang after the breach. Trezor has a history of third-party breaches: in January 2024, it disclosed another data breach after its third-party support ticketing portal was compromised and attackers accessed data such as names, usernames, and email addresses from roughly 66,000 users.
A related headline notes that Trezor reported 347,000 users targeted in phishing attacks after a Brevo breach.
Broader security wave
The incident is part of a broader wave of security news, including AdaptHealth’s confirmation that 4.1 million people were exposed in a July cyberattack, Microsoft’s September 2026 Patch Tuesday fixing 966 flaws and 2 zero-days, over 36,000 exposed Plex servers vulnerable to recent flaws, a new Microsoft Defender ‘ShieldCrash’ zero-day granting SYSTEM access, GitLab urging users to patch a max severity path traversal flaw, and Microsoft fixing Teams and Outlook launch failures on ARM Windows PCs.
The Trezor warning underscores the recurring risk that hardware wallet makers face when customer data held by third-party vendors is compromised, enabling targeted phishing against users who hold crypto assets. Watch this space — the shift is toward attackers treating vendor ecosystems, not the wallets themselves, as the softest target.
