Trezor users were alerted on Wednesday to a phishing campaign that originated from a breach of the company’s third-party email provider. The fraudulent email, disguised as a critical security alert, falsely claimed a vulnerability in STM32 microcontrollers affecting Trezor devices and urged recipients to click a malicious link.
Trezor stated the email was not from them and issued a warning to users after 4:30 p.m. Eastern Time. However, users reported receiving the deceptive message hours earlier, appearing to come from a legitimate Trezor email address. The fake alert claimed that engineers had discovered a “critical hardware-level vulnerability” in the STM32 microcontrollers used in Trezor devices, alleging that an estimated one in four devices could be affected. This claim likely played on recent fears within the cryptocurrency community, particularly concerning the Coldcard exploit that reportedly cost users over $130 million in Bitcoin.
“Please be aware that the email named ‘Critical Security Alert: STM32 Entropy Vulnerability’ is not coming from us, and it’s a phishing attempt. Do not click on any link,” Trezor stated in its warning. The company has since taken down the domain used in the attack and is investigating how hackers gained access to the email provider. The exact third-party email provider that was compromised remains uncertain, as does the full scope of how hackers gained access.
Security professionals noted that such attacks often leverage compromised third-party services. Nick Neuman, co-founder and CEO of Casa, suggested that a marketing email provider was likely compromised. Similarly, Jameson Lopp, a Bitcoin security researcher, posted that threat actors may have compromised the email providers used by both Trezor and BitBox. Lopp added that malicious emails claiming issues with random number generators (RNGs) requiring security updates were being sent and did not appear to be spoofed, emphasizing that “No such security advisory has been issued!”
This incident echoes previous security concerns within the hardware wallet ecosystem. In August, Trezor and Foundation issued warnings about phishing attempts that exploited fears surrounding hardware wallet vulnerabilities, following disclosures affecting Coldcard devices. In the same month, Trezor reported a breach at its shipping provider, ShipMonk, which exposed customer data for 80,689 individuals, including names, email addresses, phone numbers, and shipping addresses. Trezor had cautioned that this leaked information could be used for more sophisticated phishing attacks.
The recurring nature of third-party service compromises highlights a significant and persistent threat to cryptocurrency companies and their users, underscoring the need for constant vigilance and verification of all communications.
Why This Matters
The materials describe a narrow update: Hackers gained access to Trezor’s third-party email provider and sent a phishing email disguised as a critical security alert. How hackers gained access to Trezor’s legitimate domain.
Broader Context
Source materials place the factual news in this context: Trezor warned users Wednesday that hackers breached its third-party email provider and used it to distribute a phishing email disguised as a critical security warning.
Leave a Reply