Headline and Key Facts

• Hardware wallet makers Trezor and BitBox warned users about phishing emails that impersonate urgent security notices.
• Trezor said its email provider was breached and flagged a fraudulent message titled “Critical Security Alert: STM32 Entropy Vulnerability.”
• BitBox said its preliminary review pointed to a compromise at its newsletter provider, with multiple Bitcoin companies apparently targeted through a shared provider.
• The warnings follow an August 13 breach at Trezor shipping provider ShipMonk that exposed data belonging to nearly 14,000 customers, and a September 4 disclosure that another 67,000 US customers were affected.
• In July, BitBox said its devices were unaffected by a vulnerability involving Coldcard’s random-number generation. In August, BitBox released firmware updates for two severe vulnerabilities, with no known exploitation or stolen funds.

Hardware wallet manufacturers Trezor and BitBox have issued urgent warnings to their users after separate but apparently related phishing campaigns attempted to exploit trust in the companies’ security communications. The fraudulent messages arrived disguised as critical security alerts, a tactic that has become increasingly common in the cryptocurrency sector as attackers seek to trick self-custody users into clicking malicious links, downloading fake firmware, or entering recovery phrases on lookalike websites.

The warnings underscore a persistent problem in the digital asset industry: even when a hardware wallet’s core security architecture remains intact, the surrounding ecosystem of email providers, shipping vendors, newsletters, and customer-support platforms can become an entry point for social engineering. In this case, the attackers did not appear to have broken the hardware wallets themselves. Instead, they targeted the communication channels that connect wallet makers with their users.

Trezor Flags Fraudulent STM32 Entropy Alert

On Wednesday, Trezor said its email provider had been breached and warned that a message titled “Critical Security Alert: STM32 Entropy Vulnerability” was fraudulent. The company urged recipients not to click any links in the message. The subject line was designed to sound technically credible, referencing STM32 microcontrollers and entropy, two terms that appear frequently in discussions about hardware wallet randomness and key generation.

In hardware wallet security, entropy refers to the randomness used to generate private keys and recovery seeds. If entropy is weak or predictable, an attacker could theoretically reconstruct a user’s wallet and steal funds. By invoking an “STM32 entropy vulnerability,” the phishing email attempted to create panic and push recipients toward a malicious link or fake remediation instructions. Trezor’s public warning made clear that the message did not originate from the company and should be treated as hostile.

The incident is especially sensitive because hardware wallet users are conditioned to take security alerts seriously. A genuine vulnerability disclosure often requires urgent action, such as updating firmware or moving funds. Attackers exploit that instinct by mimicking the tone and urgency of legitimate security notices. The result is a phishing campaign that can bypass some of the skepticism users might otherwise apply to ordinary promotional emails.

BitBox Says Newsletter Provider Likely Compromised

On the same day, BitBox warned users about a phishing email pretending to come from the company. BitBox said its preliminary review indicated that its newsletter provider was likely compromised. The company added that multiple Bitcoin companies appeared to have been targeted through a shared provider, suggesting the campaign may have been broader than a single wallet maker’s mailing list.

If a shared newsletter provider was indeed breached, the attackers may have gained access to contact lists, email templates, or sending infrastructure. That would allow them to distribute messages that look authentic at first glance, often passing through email filters because they originate from legitimate bulk-mail systems. The shared-provider angle also raises the possibility that other crypto businesses beyond Trezor and BitBox were either targeted or used as unwitting vectors.

BitBox’s warning followed a similar pattern to Trezor’s: an unexpected security notice, a request for urgent attention, and the risk that users could be directed to a credential-harvesting page or malware download. The company’s preliminary assessment did not indicate that wallet devices were compromised, but the phishing attempt itself represented a direct threat to user funds if recipients were tricked into revealing sensitive information.

Why Hardware Wallet Phishing Remains Effective

Hardware wallets are designed to keep private keys offline and require physical confirmation for transactions. That model has proven resilient against many remote attacks. However, the security benefits of self-custody depend heavily on user behavior. If a user is tricked into entering a recovery phrase on a phishing site, or into installing malicious software, the hardware wallet’s protections can be undermined.

Phishing attacks against hardware wallet users often follow a familiar playbook. The attacker sends an email that appears to come from a trusted brand. The message may warn of a critical vulnerability, a suspended account, a failed shipment, or a required firmware update. It then includes a link to a fake website that closely resembles the real company’s domain. On that site, the user may be asked to enter their seed phrase, connect their wallet, or download a file that installs malware.

Because hardware wallet owners are often more security-conscious than average crypto users, attackers must work harder to seem legitimate. They may use correct terminology, reference real products, or time their messages around actual industry events. The Trezor phishing email’s use of “STM32 Entropy Vulnerability” is a prime example: it borrows technical language that would be familiar to hardware wallet users and creates a plausible-sounding emergency.

Recent Security Disclosures Across the Sector

The latest phishing warnings did not occur in isolation. They followed several recent security disclosures across the hardware-wallet sector, creating an environment in which users are already primed to expect bad news.

ShipMonk Breach and Customer Data Exposure

On August 13, a breach at Trezor shipping provider ShipMonk exposed data belonging to nearly 14,000 customers. On September 4, Trezor disclosed that another 67,000 US customers were affected. Shipping providers often hold names, addresses, phone numbers, and order details. While this information does not directly give attackers access to wallets, it can be used for highly targeted phishing, physical mail scams, and identity theft.

For hardware wallet users, a leaked home address is more than a privacy problem. It can increase the risk of targeted intimidation, fake delivery notices, or social-engineering calls that reference a real purchase. Attackers who know a user’s name, address, and device model can craft a more convincing message than a generic phishing email. That context makes the combination of a shipping breach and a separate email-provider compromise particularly concerning.

Coldcard Random-Number Generation Vulnerability

In July, BitBox said its devices were unaffected by a vulnerability involving Coldcard’s random-number generation. Randomness is fundamental to cryptographic security. If a device generates predictable keys, an attacker may be able to reproduce them and steal funds without ever touching the victim’s hardware. The disclosure prompted scrutiny across the hardware wallet industry, with users asking manufacturers to explain how their devices generate entropy and what safeguards are in place.

BitBox’s statement that its devices were unaffected was intended to reassure customers, but the broader episode highlighted how quickly a vulnerability in one product can raise questions about the entire category. Even wallet makers that are not directly affected may face increased phishing risk, because attackers can reference real vulnerabilities to make fake alerts seem credible.

BitBox Firmware Fixes for Severe Vulnerabilities

In August, BitBox released an update fixing two severe firmware vulnerabilities. The company said there was no known exploitation or stolen funds reported at the time. Firmware vulnerabilities are especially serious because they reside in the software that controls the device’s security functions. A flaw could, in theory, allow an attacker to bypass protections, extract secrets, or manipulate transaction signing.

The absence of known exploitation is reassuring, but it does not eliminate the need for prompt updates. Users who delay firmware upgrades may remain exposed to flaws that have already been patched. Attackers, meanwhile, may monitor disclosure timelines and target users who are slow to update. This dynamic creates another opportunity for phishing: a fake “critical firmware update” email can trick users into installing malware instead of legitimate software.

What Users Should Do

Security experts consistently recommend that hardware wallet users treat unsolicited security alerts with suspicion. Instead of clicking links in emails or messages, users should navigate directly to the manufacturer’s official website or open the official app. Recovery phrases should never be entered online, shared with support staff, or stored digitally. Firmware updates should only be performed through verified channels.

• Do not click links in unexpected emails, even if they appear to come from a known hardware wallet brand.
• Never enter a recovery seed phrase on a website, in a chat, or into any software other than the hardware wallet itself.
• Verify security alerts by visiting the company’s official website directly or using an official app.
• Use unique passwords and hardware-based two-factor authentication for exchange and email accounts.
• Be cautious of messages that create urgency, reference real vulnerabilities, or ask for wallet connections.
• Keep firmware up to date, but only through official update mechanisms.

Users should also consider how much personal information is tied to their crypto purchases. Shipping data, newsletter subscriptions, and support tickets can all become phishing ammunition if a third-party provider is breached. Using aliases, separate email addresses, and privacy-focused shipping options may reduce exposure, though it cannot eliminate risk entirely.

Broader Implications for Crypto Security

The Trezor and BitBox warnings illustrate a recurring theme in crypto security: the weakest link is often not the cryptographic core but the human and organizational perimeter around it. Hardware wallets are built to withstand remote attacks, yet their users can still be compromised through email, websites, and social engineering. Third-party service providers expand the attack surface because they hold customer data and communicate directly with users.

For wallet manufacturers, the incidents raise questions about vendor security, breach notification, and user education. Companies may need to move away from email as a primary channel for urgent security alerts, or at least adopt stronger authentication markers such as signed messages, in-app notifications, and public key verification. Users, in turn, need to develop habits that treat every unsolicited security message as potentially hostile until verified independently.

The shared newsletter provider angle is particularly notable because it suggests an attacker may have targeted multiple Bitcoin companies at once. Supply-chain and vendor-focused attacks allow adversaries to scale their efforts without breaching each victim individually. If one email service, shipping provider, or marketing platform serves many crypto businesses, compromising it can yield access to a large pool of high-value targets.

As the hardware wallet sector continues to mature, the industry is likely to face more attempts to exploit the trust between manufacturers and their customers. The latest phishing wave may not have compromised any devices, but it succeeded in forcing two major wallet makers to issue public warnings and remind users that security is a shared responsibility. The companies’ devices may remain secure, but the battle for user trust is fought across every email, newsletter, and support message that reaches an inbox.

Source:Cointelegraph News