Trezor's email system hijacked to send fake 'security alert' phishing to customers
Criminals used a breached third-party email provider to send phishing from a real Trezor address, weeks after a separate shipping-partner breach ballooned to 81,000 customers.
Key points
- Trezor confirmed on Wednesday that its third-party email provider was breached and used to send phishing emails from its real help@trezor.io address.
- The fake emails carried the subject "Critical Security Alert: STM32 Entropy Vulnerability" and tried to trick wallet owners into exposing their recovery seeds.
- A separate breach at shipping partner ShipMonk, first disclosed in August, now affects 81,000 Trezor customers, up from an initial 14,000.
- The ShipMonk intrusion is linked to a critical SQL injection zero-day in Metabase, with extortion demands sent by the ShinyHunters gang.
- This is the third third-party breach hitting Trezor customers in under two years, after a support-portal incident exposed 66,000 users in January 2024.
Cryptocurrency hardware wallet maker Trezor told customers on Wednesday that criminals broke into its outside email provider and used the access to send phishing emails from Trezor's real address.
A hardware wallet is a small physical device that stores the secret keys to someone's cryptocurrency offline. If an attacker gets the recovery phrase, known as a seed, they can drain the wallet from anywhere in the world.
What did the fake emails say?
The emails arrived from help@trezor.io with the subject line "Critical Security Alert: STM32 Entropy Vulnerability". They claimed a flaw in the STM32 microcontroller chip inside Trezor devices could let attackers guess the wallet's seed by brute force, meaning trying vast numbers of combinations until one works. None of it was true.
"Our third-party e-mail provider has been breached," Trezor said in its warning. "Please be aware that the email named 'Critical Security Alert: STM32 Entropy Vulnerability' is not coming from us, and it's a phishing attempt. Do not click on any link."
Trezor said it has taken down the domain used in the scam and is investigating how the attackers reached its legitimate sending infrastructure. It has not named the email provider.
How does this connect to the ShipMonk breach?
Separately, Trezor disclosed a data breach in August involving ShipMonk, the logistics company that ships its wallets. On Friday, Trezor updated the number of affected customers from roughly 14,000 to 81,000 after a follow-up review found another 67,000 U.S. Buyers had been caught up in it. We covered that update on 5 September in "Trezor Customers Caught in a Second Wave of ShipMonk Data Leak".
Stolen records include full names, shipping addresses, phone numbers and email addresses for people who received orders between 10 May and 8 August 2026. Customers in Brazil, Colombia, Italy, Portugal, Sweden and the United Kingdom were also affected.
According to breach notification emails first reported by BleepingComputer, the attackers got into ShipMonk by exploiting a flaw in Metabase, an open-source analytics tool. Metabase confirmed in early August that criminals were using a critical SQL injection zero-day to take administrator control of customer instances and steal data. A zero-day is a software bug the maker did not know about before attackers started using it. ShipMonk was then hit with extortion demands from ShinyHunters, a group that has also targeted Carhartt and, more recently, Florida's DMV system.
Is this the first time Trezor customers' data has leaked?
No. In January 2024, Trezor disclosed that a third-party support ticketing portal had been breached, exposing names and email addresses for about 66,000 users. That incident, the ShipMonk breach and now the email provider hijack add up to three outside-supplier failures in less than two years.
| Incident | Disclosed | People affected | Data or method |
|---|---|---|---|
| Support portal breach | January 2024 | ~66,000 | Names, usernames, emails |
| ShipMonk shipping data | August 2026 (updated) | 81,000 | Names, addresses, phones, emails |
| Email provider hijack | September 2026 | Not disclosed | Phishing from real Trezor address |
Should you worry?
Yes, particularly if you received a ShipMonk order during that May-to-August window. Attackers now know your home address and know you own a crypto wallet. That pairing is genuinely dangerous in ways a leaked email address is not: expect phishing by post, phone and SMS, and flag it to anyone else in the household who might answer the door or open the mail. Never enter your recovery seed into a website or an app under any circumstances. Trezor will never ask for it.
The real story here isn't the phishing email itself. It's that Trezor's customer data keeps leaking through partners the company chooses but apparently cannot audit. At some point that pattern becomes a vendor-management problem, not a run of bad luck.
