Trezor Alerts Users to Phishing Attack via Breached Email Provider

Trezor Issues Warning on Phishing Emails

Trezor, a prominent hardware wallet manufacturer, has alerted its users to a phishing attack stemming from a breach of its third-party email provider. The fraudulent emails, which falsely claimed to address a critical vulnerability in Trezor devices, have raised security concerns among users.

The phishing email, titled "Critical Security Alert: STM32 Entropy Vulnerability," misled recipients into believing that a significant hardware flaw affected approximately 25% of Trezor devices, potentially compromising the randomness of recovery phrases. This warning came in the wake of recent vulnerabilities identified in other hardware wallets, which have resulted in substantial financial losses.

In response to the incident, Trezor has disabled the compromised domain and is investigating the breach's origins. The company emphasized that the email was not legitimate and advised users to refrain from clicking any links contained within it. Trezor made this announcement shortly after receiving reports from users who believed the email was genuine.

Security experts are concerned that this phishing attempt may not be isolated to Trezor. Nick Neuman, CEO of Casa, noted he has received similar reports from users of BitBox, indicating a potential widespread issue affecting hardware wallet email services. He urged users to remain cautious with emails prompting them to click on suspicious links.

Jameson Lopp, a security researcher at Casa, echoed these concerns, suggesting that the email provider used by both Trezor and BitBox may have been compromised. He pointed out that no official security advisories have been released, underscoring the seriousness of the situation.

This phishing incident follows another breach reported by Trezor in August, where a data leak at shipping provider ShipMonk exposed personal information of nearly 81,000 customers, raising fears of further phishing attacks targeting users based on leaked data.