# Trezor Warns of Phishing Attacks After Third-Party Email Provider Breach ("STM32 Entropy Vulnerability" Lure)

> Trezor's third-party email provider was breached, letting attackers send a phishing email from the legitimate help@trezor.io address claiming a fake STM32 microcontroller entropy flaw exposed seed phrases to brute-forcing. The email passed SPF/DKIM/DMARC checks; BitBox reported a near-identical campaign the same day, pointing to a shared compromised marketing/email provider.

- **Published:** 2026-09-10T00:00:00Z
- **Last reviewed:** 2026-09-10T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2432
- **ID:** TL-2026-2432
- **Severity:** MEDIUM
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 11 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On September 10, 2026, hardware wallet manufacturer Trezor (operated by SatoshiLabs) warned customers that a third-party email provider it uses had been breached, and the access was abused to send a phishing email from Trezor's legitimate help@trezor.io address. The message, titled "Critical Security Alert: STM32 Entropy Vulnerability," falsely claimed that Trezor engineers had discovered a critical hardware-level flaw in the STM32 microcontrollers used in roughly one in four Trezor devices, alleging that recovery seed phrases could be exposed to brute-force cracking due to insufficient entropy. The email urged recipients to click a link to "update" their device, a lure engineered to harvest seed phrases or otherwise compromise victims' cryptocurrency wallets.

Because the email was sent through Trezor's own breached third-party sending infrastructure rather than a spoofed look-alike domain, it passed SPF, DKIM, and DMARC authentication checks, making it significantly more convincing than typical phishing lures that rely on cosmetically similar domains. Trezor stated the email "is not coming from us, and it's a phishing attempt," instructed customers not to click any link, took down the malicious landing-page domain, and opened an investigation into how the attackers gained the ability to send mail as its official domain.

The same day, Swiss hardware wallet maker BitBox reported a near-identical phishing campaign impersonating its own brand, stating its "newsletter provider" was very likely compromised. Security researchers -- including Casa co-founder Nick Neuman and independent researcher Jameson Lopp -- publicly assessed that a single shared third-party email/marketing provider used by multiple cryptocurrency companies had likely been compromised and abused to launch coordinated phishing against both vendors' customer bases simultaneously. The specific provider has not been publicly confirmed by either Trezor or BitBox as of this writing.

The incident is the latest in a string of third-party vendor compromises reaching Trezor's customers: in January 2024 a breach of Trezor's third-party support ticketing portal exposed roughly 66,000 (later revised to 80,689) customers' names and emails and was likewise followed by phishing attempts, and in August-September 2026 a breach at fulfillment partner ShipMonk (via a critical SQL-injection flaw, CVE-2026-72898, in ShipMonk's Metabase deployment) exposed shipping and contact data for roughly 81,000 Trezor customers. While unrelated in root cause, these incidents collectively illustrate a recurring risk pattern: Trezor's own hardware and firmware are not implicated, but repeated breaches of the third-party vendors that hold or transmit Trezor customer contact data create a steady supply of credible pretexts and target lists for social-engineering campaigns against cold-storage wallet holders.

## MITRE ATT&CK

- T1589.002 Gather Victim Identity Information: Email Addresses
- T1583.001 Acquire Infrastructure: Domains
- T1584.006 Compromise Infrastructure: Web Services
- T1586.002 Compromise Accounts: Email Accounts
- T1566.002 Phishing: Spearphishing Link
- T1199 Trusted Relationship
- T1204.001 User Execution: Malicious Link
- T1684.001 Impersonation
- T1078.004 Valid Accounts: Cloud Accounts
- T1657 Financial Theft

## Sources

- [Trezor warns users of email provider breach, phishing attacks](https://www.bleepingcomputer.com/news/security/trezor-warns-users-of-email-provider-breach-phishing-attacks/)
- [Trezor says third-party security breach led to phishing emails from legitimate domain](https://www.theblock.co/news/defi/2026-09-09-trezor-phishing-emails-414086)
- [Bitcoin Wallet Maker Trezor Says Hackers Breached Its Email Provider](https://decrypt.co/377831/bitcoin-wallet-trezor-hackers-breach-email)
- [Fake Security Emails Target Trezor and BitBox Users](https://cointelegraph.com/news/trezor-bitbox-hardware-wallet-phishing-emails)
- [Multiple hardware crypto wallet providers warn of phishing emails after third-party incident](https://www.cyberdaily.au/security/14172-multiple-hardware-crypto-wallet-providers-warn-of-phishing-emails-after-third-party-incident)
- [Trezor data breach impact now reaches 81,000 customers](https://www.bleepingcomputer.com/news/security/trezor-data-breach-impact-now-reaches-81-000-customers/)
- [Explained: The Trezor/ShipMonk Breach (August 2026)](https://www.halborn.com/blog/post/explained-the-trezor-shipmonk-breach-august-2026)
- [Trezor support site breach exposes personal data of 66,000 customers](https://www.bleepingcomputer.com/news/security/trezor-support-site-breach-exposes-personal-data-of-66-000-customers/)
- [Trezor security alert: Stay vigilant against a potential phishing attack](https://blog.trezor.io/trezor-security-update-stay-vigilant-against-potential-phishing-attack-bb05015a21f8?gi=38e1ffb654c5)
- [Trezor (@Trezor) official statement on X](https://x.com/Trezor/status/2097786518110609620)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2432