# Trezor and BitBox Alert Users to Phishing Campaign via Breached Email Provider Hardware wallet companies warn of fake security alerts after third-party email breach. - **Source:** [DailyCoin](https://brifing.si/source/3e9b0f85-cb2f-40ee-ba61-db9410cf0937) - **Published:** 2026-09-10 - **Topic:** [Finance](https://brifing.si/c/finance) - **Original article:** - **On Brifing:** https://brifing.si/s/337f50f1-98e9-4680-b6f8-11315cf299b1 ## Phishing Campaign Details Trezor and BitBox, two leading hardware wallet companies, have warned users about a phishing campaign following a breach of a third-party email provider. The fraudulent emails, titled 'Critical Security Alert: STM32 Entropy Vulnerability,' falsely claimed a hardware flaw in Trezor wallets. The emails urged recipients to click on malicious links, potentially compromising their crypto assets. Trezor confirmed the emails were not legitimate and advised users to avoid clicking any links. ## Impact on Users The phishing emails targeted Trezor and BitBox users, claiming a critical vulnerability in STM32 microcontroller chips used in their hardware wallets. The fake alerts suggested that a quarter of devices were affected due to insufficient entropy in private key generation. If users had fallen for the scam, they could have exposed their seed phrases, putting their crypto assets at risk. Both companies are investigating the breach and have taken steps to mitigate the damage. ## Response from Trezor Trezor acted swiftly by shutting down the exploited domain and sending email updates to affected users. The company emphasized that the phishing emails did not originate from them and warned users to remain vigilant. Security firm PeckShield confirmed that the sender address was spoofed to appear as help@trezor.io. Trezor is also investigating how the attackers gained access to the infrastructure used in the campaign. ## BitBox's Alert BitBox, a Swiss hardware wallet manufacturer, reported similar phishing attempts impersonating its brand on the same day. The company alerted users via social media, advising them not to follow instructions in the fraudulent emails. BitBox is currently investigating the incident, which suggests a possible compromise of a shared marketing email provider used by multiple hardware wallet companies. ## Industry-Wide Implications Nick Neumann, CEO of Casa, a Bitcoin self-custody company, suggested that a shared marketing email provider might have been compromised. This breach could affect not only Trezor and BitBox but also other companies relying on the same provider. The incident highlights the risks of third-party vendors handling sensitive customer communications, especially in the crypto industry where security is paramount. ## Previous Security Incident This phishing campaign follows a separate security incident in August 2026, where Trezor suffered a supply-chain attack. Personal information of 80,689 customers was exposed through Trezor's shipping contractor, ShipMonk. The leaked data included names, phone numbers, and addresses, with 1,947 customers having only their names, cities, and email addresses exposed. These incidents underscore the vulnerabilities in third-party vendor relationships. ## Risks of Phishing in Crypto Phishing campaigns impersonating trusted hardware wallet brands can trick users into revealing recovery phrases or wallet backups. Such scams pose significant risks to crypto assets, as attackers can gain full control over victims' funds. The recent incidents also highlight the broader security challenges faced by crypto companies, particularly when relying on external vendors for critical operations like customer communications. ## Key Takeaways The Trezor and BitBox phishing incidents serve as a stark reminder of the importance of cybersecurity in the crypto space. Users must remain cautious of unsolicited emails, even those appearing to come from trusted sources. Companies, on the other hand, need to scrutinize their third-party vendors and implement robust security measures to protect customer data. These events could prompt stricter industry standards for vendor management and email security. ## Sources covering this story - https://dailycoin.com/trezor-bitbox-phishing-third-party-email-breach/ — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._