Trezor’s Email Provider Breached, Fake STM32 Vulnerability Alert Sent to Users

Trezor has confirmed that a third-party email provider it uses was breached, allowing attackers to send a fraudulent security alert to wallet holders. Two independent reports, from Decrypt and AMBCrypto, corroborate the core facts: a fake email claiming a hardware flaw could expose users’ recovery phrases went out from what looked like a legitimate Trezor domain, and the company has taken that domain down while it investigates.

What Two Sources Confirm

The phishing email carried the subject line “Critical Security Alert: STM32 Entropy Vulnerability,” according to both Decrypt and AMBCrypto. It warned recipients that their hardware wallets faced an immediate risk and pushed them toward a link.

That link led to a site asking visitors to submit confidential wallet details, AMBCrypto reported. Trezor addressed the message directly in a public statement, saying: “The email…is not coming from us, and it’s a phishing attempt.”

Because the message originated from a genuine Trezor-linked domain, it could pass casual sender checks that would normally flag a spoofed address. That detail appears in both accounts and is the reason Trezor is now investigating how attackers gained access to the domain in the first place, rather than simply blocking a lookalike address.

What Remains Unconfirmed

Neither report specifies how many customers received the fake alert, which region the third-party provider serves, or whether any users actually submitted wallet data before the domain was pulled offline. BeInCrypto also covered the story under the headline “Trezor Reports Another Security Incident,” which lines up with the breach claim but did not add verifiable detail beyond what Decrypt and AMBCrypto already documented.

There is no claimed link between this email breach and the STM32 chip itself. The vulnerability named in the phishing subject line does not appear to be real; it functions as bait, not as a disclosed hardware defect.

A Repeat Vendor Problem

This is not Trezor’s first vendor-side exposure this year. In an earlier incident, a fulfillment partner’s undeleted records widened an existing breach by roughly 67,000 US customer entries, a separate event from this email compromise but part of the same pattern: attackers reaching Trezor users through a partner’s systems rather than through the hardware itself.

For holders of any hardware wallet, the practical guidance from Trezor is straightforward. Do not click links in unsolicited security emails, verify alerts through the company’s official channels, and treat any message urging immediate action on a recovery phrase as suspicious by default. A recovery phrase never needs to be typed into a website.

Read more: Trezor Breach Grows by 67,000 US Records After ShipMonk Data Wasn’t Deleted

Trezor has not published a customer count affected by this phishing wave as of publication. The company’s stated next step is limited to the domain takedown and an internal investigation into the access point.

Sources

• decrypt.co
• ambcrypto.com
• beincrypto.com