Trezor Claims Third-Party Email Provider Hacked and Warns of Phishing Emails
Hardware wallet provider Trezor has stated that its third-party email service provider was hacked, allowing attackers to send phishing emails with the subject "Critical Security Alert: STM32 Entropy Vulnerability," and has advised users not to click on any links. The company has shut down the related domains and is still investigating how access was gained to the legitimate sending domain.
The emails were sent from an authenticated email subdomain and could pass SPF, DKIM, and DMARC checks, appearing in inboxes as official communications. The message claimed that the STM32 chip had a factory defect, with about a quarter of devices having insufficient seed entropy of approximately 40 bits, and provided a link to "check if affected," which pointed to a click-tracking subdomain of the email platform. Trezor stated that the emails were not sent by them; device firmware, private keys, and recovery phrases were not exposed. Some analyses indicated that after the shutdown, the authentication was dismantled, and link handshakes failed. This incident is separate from the August leak by logistics partner ShipMonk, which disclosed customer names, addresses, phone numbers, and emails, with the updated scale exceeding 80,000 entries, increasing the success rate of targeted phishing. The bait is closely related to recent discussions about thefts caused by entropy issues in other hardware wallet firmware. There are also voices suggesting that similar themes may affect users of other brands. Trezor and its parent company SatoshiLabs have historically issued warnings about abuse of support portals or email providers, emphasizing that they never ask for recovery phrases.
In market mechanisms, buyers are users holding cold wallets who are sensitive to chip vulnerabilities, while sellers are attackers controlling email channels; the driving force is real security news providing the narrative. Funds are transferred from deceived users' chains to phishing sites, rather than entering Trezor's vault. The beneficiaries are the intruders who can create clickable official envelopes, while the brands that must explain "the message is a real channel, but the content is fake" and the customer list that has just been leaked by the logistics provider are under pressure.
Source: Public Information
ABAB AI Insight
The attack surface for hardware wallets is no longer primarily on the chip's main path, but rather with outsourced email providers. Authentication protocols can only prove that the message came from an authorized domain, not that the button behind it is from the manufacturer. Writing STM32 entropy in the title is copying theft news from other companies into the fear accounts of their own users. The logistics leak first disclosed names and addresses, and the email provider then delivered the official envelope, completing a supply chain assembly within two weeks.
The capital path is that security brands outsource manufacturing, compliance, and mass mailing, leaving only the keys in the device. Profits come from selling boxes, while risks arise from the contact lists that must remain when selling boxes. Each third-party incident reinforces the doctrine of "never connect recovery phrases to the internet" and increases distrust of official emails, raising customer service costs. Competitors also rely on the same type of email platforms, making the channel's compromise contagious within the industry.
Similar to years of phishing after the Ledger customer data leak, and exchanges sending announcements to hijacked domains. The industry phase is a split between device security and identity security: chips can go ten years without remote theft, while contact lists can be compromised three times in a year. Anyone still using the same "urgent security notification" template is providing attackers with a reusable script.
Structurally, this represents a breakdown of trust in the reconstruction of the industry chain: the edge services of security products are treated as attack entry points. The mechanism is that domain authentication lowers user vigilance, real vulnerability news provides the narrative, and leaked lists provide delivery precision; the more manufacturers emphasize off-chain key security, the more attackers specialize in targeting the off-chain notification layer.
ABAB News · Cognitive Law
Authenticated messages only prove that the channel has been compromised
Cold wallet theft often starts from hot email accounts
Security companies that outsource email also outsource trust