Trezor warns users about email provider hacks and phishing attacks

Cryptocurrency hardware wallet maker Trezor warned customers on Wednesday that attackers who hacked its third-party email provider are targeting them in phishing attacks.

Affected customers received fake “critical security alert” emails from help@trezor.io, which claimed that a “microcontroller hardware vulnerability” in the STM32 microcontrollers used in Trezor’s cold storage wallets could expose their seeds to brute-force hacking.

The company said it was investigating the breach and that the domain had been taken down to stop the attacks.

“Our third party email provider has been hacked. Please be aware that the email titled “Critical Security Alert: STM32 Entropy Vulnerability” is not from us and is a phishing attempt. Don’t click on any links,” Trezor warned.

“We have disabled the domain and are investigating the situation, including how hackers gained access to our legitimate domain.”

Trezor also reported a data breach in August after attackers hacked ShipMonk, its shipping and logistics provider, and stole customer order data, including full names, shipping addresses, email addresses and phone numbers.

While the company initially said the incident affected nearly 14,000 customers, Friday’s post warned that a subsequent investigation found the breach affected an additional 67,000 U.S. customers, bringing the total to 81,000.

As Tresor explained, the data leak also affected customers in Brazil, Colombia, Italy, Portugal, Sweden and the UK, who received orders between May 10 and August 8, 2026. While the company did not specify how ShipMonk’s systems were hacked, hack notification emails reviewed by BleepingComputer said the attackers exploited a vulnerability in the Metabase analytics platform.

In early August, Metabase said attackers exploited a critical zero-day SQL injection vulnerability to compromise client instances, gain administrative access, and steal data.

BleepingComputer also learned that after the hack, ShipMonk received extortion emails from the ShinyHunters ransomware gang.

In January 2024, Trezor reported another data breach after its third-party support ticket portal was compromised and attackers gained access to data (such as names, usernames, and email addresses) of approximately 66,000 users.