The email looked urgent. It came from [email protected], carried the subject “Critical Security Alert: STM32 Entropy Vulnerability”, and claimed a “hardware microcontroller vulnerability” in the STM32 chips inside Trezor’s cold storage wallets could let attackers brute-force a user’s seed.
It was a phishing attempt. Trezor, the cryptocurrency hardware wallet maker, told customers on Wednesday that the senders had broken into its third-party email provider.
“Our third-party e-mail provider has been breached. Please be aware that the email named ‘Critical Security Alert: STM32 Entropy Vulnerability’ is not coming from us, and it’s a phishing attempt. Do not click on any link,” the company warned. “We have taken down the domain, and we are investigating the situation, including how the hackers got access to our legit domain.”
Not the first vendor to fail
This follows a breach Trezor disclosed in August. Attackers had hacked ShipMonk, its shipping and logistics provider, and taken order data: full names, shipping addresses, email addresses and phone numbers.
The first count was nearly 14,000 customers. A Friday update raised it. A further investigation found another 67,000 U.S. customers affected, for a total of 81,000. Customers in Brazil, Colombia, Italy, Portugal, Sweden and the United Kingdom were hit too, if their orders were placed between May 10 and August 8, 2026.
Trezor did not say how ShipMonk was compromised. Breach notification emails seen by BleepingComputer pointed to a flaw in the Metabase analytics platform. Metabase itself said in early August that attackers had used a critical SQL injection zero-day to get into customer instances, gain administrator access and steal data. BleepingComputer also learned that the ShinyHunters extortion gang sent ShipMonk extortion emails after the breach.
Trezor has been here before. In January 2024 it disclosed that its third-party support ticketing portal had been compromised, exposing names, usernames and email addresses for roughly 66,000 users.
