Hardware wallet provider Trezor has stated that its third-party email service provider was hacked, allowing attackers to send phishing emails with the subject "Critical Security Alert: STM32 Entropy Vulnerability," and has advised users not to click on any links. The company has shut down the related domains and is still investigating how access was gained to the legitimate sending domain.

The emails were sent from an authenticated email subdomain and could pass SPF, DKIM, and DMARC checks, appearing in inboxes as official communications. The message claimed that the STM32 chip had a factory defect, with about a quarter of devices having insufficient seed entropy of approximately 40 bits, and provided a link to "check if affected," which pointed to a click-tracking subdomain of the email platform. Trezor stated that the emails were not sent by them; device firmware, private keys, and recovery phrases were not exposed. Some analyses indicated that after the shutdown, the authentication was dismantled, and link handshakes failed. This incident is separate from the August leak by logistics partner ShipMonk, which disclosed customer names, addresses, phone numbers, and emails, with the updated scale exceeding 80,000 entries, increasing the success rate of targeted phishing. The bait is closely related to recent discussions about thefts caused by entropy issues in other hardware wallet firmware. There are also voices suggesting that similar themes may affect users of other brands. Trezor and its parent company SatoshiLabs have historically issued warnings about abuse of support portals or email providers, emphasizing that they never ask for recovery phrases.

In market mechanisms, buyers are users holding cold wallets who are sensitive to chip vulnerabilities, while sellers are attackers controlling email channels; the driving force is real security news providing the narrative. Funds are transferred from deceived users' chains to phishing sites, rather than entering Trezor's vault. The beneficiaries are the intruders who can create clickable official envelopes, while the brands that must explain "the message is a real channel, but the content is fake" and the customer list that has just been leaked by the logistics provider are under pressure.

Source: Public Information