Last night an email hit my inbox with the subject line “Critical Security Alert: STM32 Entropy Vulnerability.” The sender read noreply@trezor.io, the real domain, and it sailed through every authentication check Gmail runs. According to the message, a factory defect in the STM32 chips inside Trezor devices left one in four wallets with weak seed phrases that attackers could brute-force.
Professionally written, technically plausible, and completely fake.
Three weeks ago I warned that phishing attempts would follow the Trezor customer data leak. I did not expect the wave to arrive through Trezor’s own email infrastructure. Let’s unpack the scam, the company’s response, and the breach numbers that quietly grew much larger since my last update.
A Phishing Email Sent Through Trezor’s Real Domain
This campaign stands out because nothing about the sender looked wrong. The attackers breached the third-party email provider Trezor uses for its newsletter, then blasted the fake alert to the subscriber database through the company’s legitimate mailing domain. SPF, DKIM, and DMARC all passed. Every trick we teach people for spotting spoofed senders failed here, because the sender was technically genuine.
On September 9, Trezor confirmed the breach on X, told users not to click any links, and took down the domain behind the campaign. Within hours, the SPF record for the compromised mailing subdomain was withdrawn, cutting off further authenticated sends.
Trezor wasn’t alone either. BitBox reported an almost identical phishing email to its own newsletter subscribers the same day, and its preliminary review pointed to a compromised newsletter provider shared by several Bitcoin companies. Casa’s team flagged the same pattern. One vendor breach, multiple hardware wallet brands, one coordinated scam wave.
The goal is the oldest one in the book. Versions of the email push a link to “check if your device is affected,” which leads to a page asking for your recovery phrase. Enter it, and your wallet belongs to someone else.
The Real Bug the Scammers Borrowed
Whoever wrote this email did their homework, and that’s what makes it dangerous. The technical story isn’t invented from scratch. It’s lifted from a genuine incident at a competitor.
On July 30, Coinkite disclosed an entropy bug in certain Coldcard wallets. Affected Mk3 devices generated seeds with roughly 40 bits of effective entropy instead of 128, and attackers brute-forced the reduced search space to sweep around 594 BTC before disclosure. We covered the full story in our Coldcard safety breakdown.
The scammers took that real 40-bit number, swapped Coldcard for Trezor, and dressed it up as a hardware factory defect. Anyone who half-remembers the recent headlines will find it credible.
Here’s the part that matters: Trezor devices were never affected by the Coldcard bug. Trezor published a detailed response back in August confirming that all its models combine multiple independent entropy sources and generate at least 128-bit entropy under default settings. There is no STM32 factory defect, no 40-bit seed problem, and no list of “affected customers” being contacted.
One more tell worth learning from. The phishing email itself warns you to “never enter your recovery phrase on a website.” Scammers include that line deliberately, because sounding security-conscious buys your trust before the follow-up strikes.
Trezor’s Warning Email
The day after, a second email arrived, and this one is legitimate. Trezor issued a warning about the unauthorized email sent to its newsletter database through the third-party email service provider, with clear instructions for anyone who received the fake alert.
The short version of their guidance:
- Do not click any links in the phishing email or hand over personal information
- Delete the message so you can’t interact with it by accident later
- If you entered your wallet backup anywhere, especially through a link in such an email, move your funds to a new wallet immediately
- If your backup never left your Trezor device, your assets remain secure
Credit where due: the response came fast, the domain takedown happened within hours, and the follow-up communication is clear. The uncomfortable part is that this marks yet another Trezor vendor failing in the span of a single month.
The Data Breach Is Far Bigger Than First Reported
Back in August, we broke down the Trezor data breach at ShipMonk, the company’s shipping partner. The initial disclosure counted 13,689 exposed customers across seven countries.
That number didn’t hold. On September 4, Trezor expanded the disclosure: roughly 67,000 additional US customers had their names, phone numbers, and home addresses exposed in the same incident. Independent estimates now put the total above 80,000 people. What looked like a contained regional leak turned out to be five times larger than first reported.
So within four weeks, Trezor customers absorbed a shipping partner leaking 80,000+ records, and an email provider getting hijacked to deliver phishing straight to their inboxes. Whether the two incidents connect remains unconfirmed, but the timing is hard to ignore. Criminals now hold home addresses from one breach and a proven delivery channel from the other.
Ledger owners know this movie by heart. After Ledger’s infamous database hack, leaked customers endured years of phishing emails, threatening letters, and fake replacement devices. Trezor’s user base has now entered the same long tail, and this week’s campaign is only the opening act.
How to Protect Yourself
The playbook stays the same, but the stakes just went up because “check the sender domain” no longer guarantees anything.
- Treat every wallet-branded email as hostile by default. Real security disclosures appear on official blogs and social channels first. Type the URL yourself, never click through from an inbox.
- Your recovery phrase never goes online. No website, no form, no support chat, no “device check” tool. If you’re fuzzy on how seeds and passphrases actually work, our seed phrase and passphrase guide covers it in plain language.
- Add a passphrase to your hardware wallet. It turns a leaked or stolen seed into a dead end and costs you five minutes to set up.
- Expect letters, calls, and texts. With 80,000+ home addresses in criminal hands, physical mail scams with QR codes are a matter of time. Ledger victims received exactly those.
- Verify before you panic. Scam emails manufacture urgency. Real companies give you time.
None of this changes my view on the hardware itself. The devices keep doing their job, and our full Trezor safety review still stands. The weak link is the vendor ecosystem around the company, not the wallet in your drawer.
Keep This Content Free
Security write-ups like this one earn us nothing unless readers chip in. If you want to support the work, sign up on OKX or Bybit through our referral links and grab their deposit bonuses while you’re at it.
Final Words
September is shaping up as a brutal month for crypto security. We’ve already covered the $320 million Liquid Network hack and the Cronos rollback after the Tectonic exploit, and now the two biggest hardware wallet brands are fighting phishing waves launched from their own email channels.
The lesson from this one is uncomfortable but simple. Email authentication tells you which server sent a message, not who controls that server. When a vendor gets breached, “legitimate” email becomes the attack. Your seed phrase staying offline is the only defense that doesn’t depend on someone else’s security.
I received both emails in this story firsthand, the fake one and the real one. The fake one was better written. Stay sharp out there, and see you in the next one!
FAQ
Is the STM32 entropy vulnerability real? No. The email describing it is a phishing scam sent through Trezor’s breached third-party email provider. Trezor confirmed there is no such hardware defect, and all its models generate at least 128-bit entropy by default.
Why did the phishing email pass Gmail’s security checks? Attackers compromised the email provider Trezor uses for newsletters and sent the message through the company’s real mailing domain. Authentication checks like SPF and DKIM verify the sending server, which in this case was technically legitimate.
I clicked the link in the email. Am I in danger? Clicking alone rarely causes damage, but close the page and run a malware scan to be safe. If you typed your recovery phrase anywhere, move your funds to a freshly generated wallet right now.
Was my data exposed in the Trezor breach? If you ordered a Trezor recently, possibly. The ShipMonk incident exposed data of 80,000+ customers after the September 4 update, including roughly 67,000 in the US. Trezor emails affected customers directly.
Should I stop using my Trezor wallet? No. The devices and firmware remain uncompromised. The risk sits entirely in phishing built on leaked contact data, so your defense is skepticism toward emails, letters, and calls, not new hardware.
Credit: Source link
