🚨 Trezor Security Alert: Phishing Email Sent From Its OWN Real Domain — Here’s What You Need to Know 🔒

Hardware wallet maker Trezor confirmed today that hackers breached its third-party email provider and used it to send a phishing email through Trezor's genuine domain — no spoofing needed, which makes this campaign more dangerous than most.

The bait: An email titled "Critical Security Alert: STM32 Entropy Vulnerability" falsely claims a hardware-level flaw affects roughly 1 in 4 Trezor devices, alleging insufficient randomness ("entropy") in recovery-phrase generation. This is a calculated lure timed to exploit fears from the real, recent Coldcard exploit that cost users over $130 million in Bitcoin — worried owners are exactly the demographic this attack is designed to panic.

The reassurance: Trezor confirmed no wallets, private keys, or recovery backups were exposed. The only risk is if someone clicks the link and enters sensitive data on the resulting fake site.

The bigger red flag — this is Trezor's third vendor failure in four weeks:
1️⃣ Aug 10 — Shipping partner ShipMonk breach exposed 80,689 customers' names, phones, and addresses
2️⃣ Late August — An earlier phishing wave exploiting hardware-vulnerability fears
3️⃣ Now — This email-provider breach and STM32 phishing campaign

Casa's Nick Neuman noted the campaign may not be Trezor-exclusive — reports suggest Bitbox users received similar emails, pointing to a possibly shared, compromised marketing email vendor across multiple hardware wallet brands.

Why this matters for the whole space: 2026 is shaping up to be the worst year on record for crypto security — 180+ documented incidents in H1 alone (a 50% jump YoY), with over $1.1 billion in losses. State-sponsored actors are increasingly leveraging AI for more convincing social engineering and deepfake-driven attacks, and vendor supply-chain compromises (rather than direct hacks) are becoming the preferred entry point.

Action items: Never click links in unexpected wallet-provider emails referencing chip flaws or "entropy." Never type a recovery phrase or device passcode into any website. Verify anything unusual directly through the company's official site — never through an emailed link.

慢慢買。分批佈局。讓時間站在你這邊。🙏

— Humble Trader | Gemini Trading
🔒 Trezor | Crypto Security Watch
[NOT FINANCIAL ADVICE, DYOR!]

https://preview.redd.it/r55nhc51jloh1.png?width=467&format=png&auto=webp&s=1330b82b3eea452076a78ac9dcdec9a7e7cbbedf