Major hardware wallet manufacturers Trezor and BitBox have issued emergency warnings about a large-scale phishing campaign targeting users of their devices. Attackers are using compromised third-party email services to distribute fake notifications about critical security vulnerabilities. The attack began on Wednesday, when both companies simultaneously detected suspicious activity and warned their customers to exercise maximum caution.
The phishing campaign uses sophisticated social engineering, disguising itself as official security notifications. Attackers send emails on behalf of Trezor and BitBox, creating the impression that urgent action is required to protect users' funds. The main email uses the subject line "Critical Security Alert: STM32 Entropy Vulnerability", which sounds like an official warning about a serious vulnerability in the STM32 microcontrollers used in hardware wallets.
The attack exploits users' natural reaction to security warnings — the desire to immediately protect their crypto assets. The emails contain links leading to fake websites that imitate the official resources of wallet manufacturers. After following these links, victims are asked to enter seed phrases, PIN codes or other sensitive information under the pretext of a "security update" or "vulnerability check".
What makes the campaign particularly dangerous is that the emails arrived through companies' official communication channels, increasing recipients' trust. Many users automatically assume that messages coming from corporate email addresses are safe. This is exactly the psychological vulnerability attackers exploit by using compromised mailing infrastructure.
The investigation showed that the phishing attack resulted from the compromise of third-party services used by Trezor and BitBox for email communications. Trezor confirmed that its email provider had been breached, allowing attackers to gain access to customer data and use legitimate communication channels to distribute fraudulent messages. BitBox reported that its preliminary analysis also pointed to a compromised mailing provider.
Particularly concerning is the fact that several Bitcoin companies were attacked through a shared service provider. This points to a systemic vulnerability in the email marketing supply chain, where the compromise of a single provider can expose multiple clients at the same time. The attackers did not gain access to the wallet manufacturers themselves, but rather to the tools those companies use to communicate with users.
| Incident Date | Company | Type of Breach | Number of Affected Users |
|---|---|---|---|
| August 13 | Trezor (ShipMonk) | Shipping data leak | ~14,000 customers |
| September 4 | Trezor | Customer data leak | 67,000 customers in the U.S. |
| September (current) | Trezor and BitBox | Email service compromise | Not specified |
This phishing campaign occurred against the backdrop of a series of other security incidents in the hardware wallet sector. On August 13, a breach involving Trezor's logistics partner ShipMonk resulted in the exposure of data belonging to nearly 14,000 customers. On September 4, Trezor disclosed the compromise of data belonging to another 67,000 U.S. customers. These consecutive incidents paint a picture of systemic security problems in supply chains and third-party services.
In response to the phishing campaign, Trezor and BitBox issued clear recommendations for users. The main instruction is not to follow links in suspicious emails and not to enter sensitive information on websites reached through email messages. Both companies emphasize that they never request seed phrases, PIN codes or other critical information by email.
Users are advised to verify the authenticity of any security-related message through official channels. If you receive an email warning about a security issue, do not click the links inside it. Instead, open your browser and manually enter the manufacturer's official website address (trezor.io or bitbox.swiss). Check whether a corresponding announcement appears on the official website or company blog.
Users who have already followed suspicious links or entered information on phishing websites should immediately take steps to protect their funds. The first priority is to move all assets to a new wallet with a new seed phrase generated on a trusted device while offline. The old seed phrase should be considered fully compromised and should never be used again.
It is also recommended to check all related accounts and services where the same passwords or sensitive information may have been used. Changing passwords on all critical services and enabling additional security measures such as 2FA and hardware security keys can help minimize the potential damage from a compromise.
This phishing campaign highlights the growing sophistication of attacks targeting the crypto industry and the shift in attackers' focus from directly compromising devices to compromising communications infrastructure. Hardware wallet manufacturers have traditionally focused on the security of the devices themselves — protecting chips, isolating private keys and securely generating entropy. However, this attack showed that even the most secure device is useless if the user can be deceived through phishing.
The hardware wallet industry now faces the need to rethink its approach to user security. Technical protection measures must be complemented by educational programs and improved methods for authenticating communications. The future may involve cryptographically verifiable communication channels that allow users to mathematically confirm the authenticity of messages from manufacturers.
For users, this incident serves as a reminder of the need for constant skepticism in the digital environment. Even messages from trusted brands can be spoofed if attackers gain access to communication infrastructure. Critical thinking and verifying information through independent channels should become standard practice for all cryptocurrency users.
Wallet manufacturers will likely review their strategies for using third-party services for critical communications. Possible measures include deploying proprietary secure notification systems, using cryptographic signatures for all official messages and creating alternative communication channels that do not depend on vulnerable third parties. Investments in supply chain security and third-party provider security are likely to become a priority.
Regulators and industry organizations may consider developing security standards for email communication services in the crypto industry. Mandatory security audits of providers, requirements for message encryption and authentication, and incident response standards could all become part of future regulatory requirements designed to protect users from similar attacks.
Ultimately, this phishing campaign demonstrates the evolution of threats in the crypto space. Attackers are adapting to stronger technical defenses by finding new attack vectors through the human factor and infrastructure vulnerabilities. Effective protection requires a comprehensive approach combining technological solutions, user education and organizational security measures across every layer of the ecosystem.
“Security is not a product, but a process. In the world of cryptocurrency, even the most advanced hardware wallet is useless if the user is not trained to recognize threats and does not follow basic security practices.”
— Andreas Antonopoulos, blockchain technology and security expert
