AIBRIEF
Trezor and BitBox, makers of hardware crypto wallets, say a third party email provider used by both brands was compromised, letting attackers reach subscribers with fake security alerts.
Hardware crypto wallet brands Trezor and BitBox warned users on Thursday that phishers are impersonating their newsletters, after a third-party email service provider used by both companies was breached.
Trezor said on X that its "third-party email provider" had been compromised and that a message titled "Critical Security Alert: STM32 Entropy Vulnerability" did not come from the company. The lure domain has been taken down. BitBox said its own preliminary review pointed to a compromise of its newsletter provider and that "multiple other Bitcoin companies" were hit by the same campaign (Trezor on X, BitBox on X).
Crypto tax software Coin Tracking separately confirmed the third-party email service provider Brevo suffered a security breach and warned users about a phishing email titled "Data Breach Notice: Please refresh API Keys as soon as possible" (Coin Tracking on X). The Register, Bitcoin News, Cointelegraph, and crypto.news are running parallel coverage, though Brevo has not publicly confirmed the breach in the available sources.
The phishing reaches subscribers through the brands' own email lists, not the wallet devices. A legitimate hardware wallet vendor will never ask a user to enter their seed phrase (the master recovery word list that controls the funds) on a website or in an email form, and once that phrase leaves the device, the assets it protects can be drained.
Before acting on any wallet-related email, compare the sender domain against the brand's official site. Never enter a seed phrase in a browser or by reply; confirm any requested action on the device itself, and treat urgency cues as a phishing tell.