Trezor Hit By Third Security Breach In Four Weeks

Hardware wallet maker Trezor is dealing with its third vendor failure in four weeks after attackers breached a third party email provider. The attackers sent customers a convincing phishing email disguised as a critical chip security alert about an STM32 entropy vulnerability. Trezor confirmed that user wallets, private keys, and recovery backups remain safe, and the company quickly took down the malicious domain used in the campaign.

This incident follows a troubling string of supply chain leaks. An August incident at order shipping partner ShipMonk exposed the names, phone numbers, and home addresses of more than 80,000 customers. Similar attacks have also hit other hardware wallet brands, including BitBox, suggesting that malicious actors are actively targeting shared marketing and newsletter service providers across the crypto industry.

Crypto holders need to stay extra vigilant right now. Users should never click links in unexpected emails, and they must avoid typing recovery phrases or passcodes into any website. Anyone who already entered their backup details on a suspicious page should immediately move their funds to a fresh wallet.