Hardware wallet manufacturers Trezor and BitBox have warned users about a wave of phishing emails designed to look like urgent security notices, after suspected compromises at third-party email service providers. The warnings, issued separately, highlight a growing attack vector in the cryptocurrency hardware wallet sector: rather than breaking device encryption or stealing private keys directly, attackers are targeting the communication channels companies use to reach customers.

Trezor said its email provider had been breached and warned that a message titled 'Critical Security Alert: STM32 Entropy Vulnerability' was fraudulent. The company urged recipients not to click any links in the message. BitBox said it had identified a phishing email pretending to come from the company. A preliminary review indicated that its newsletter provider was likely compromised, and multiple Bitcoin companies appeared to have been targeted through a shared provider.

The two warnings arrived on the same day and point to a broader pattern of supply chain attacks against cryptocurrency businesses. Instead of attacking the hardware wallet itself, attackers are going after the email and marketing infrastructure that these companies rely on to communicate with their customers. That approach can allow phishing messages to pass through legitimate-looking senders, making them harder to distinguish from real security alerts.

Trezor flags fraudulent STM32 entropy alert

Trezor's warning centered on an email that claimed to describe a critical vulnerability affecting STM32 microcontrollers. The message used the subject line or title 'Critical Security Alert: STM32 Entropy Vulnerability' and appeared to come from Trezor. According to the company, the email was not legitimate. Trezor told users not to click any links and not to act on the instructions in the message.

The STM32 family of microcontrollers is widely used in embedded systems, including some hardware wallets and other security devices. Entropy, in the context of cryptography, refers to the randomness used to generate private keys and other sensitive data. A genuine entropy vulnerability would be serious, because weak randomness could make it easier for an attacker to predict or reproduce keys. However, real security advisories of that kind are typically published through official channels and accompanied by verified firmware updates or detailed technical guidance.

In a phishing campaign, the technical language is often used as bait. The attackers want recipients to panic about a supposed flaw in their device and then follow a link to a fake website. That site may ask for a recovery seed, a password, or other credentials. Once a user enters a recovery seed into a phishing page, the attacker can recreate the wallet and steal all associated funds, even if the physical device remains secure.

Trezor's guidance was straightforward: do not click the links. Users should instead verify any security notice through the company's official app, website, or support channels. Hardware wallet makers generally do not ask customers to enter their recovery seed on a website, and they do not need the seed to investigate a firmware vulnerability. That distinction is central to defending against this type of attack.

BitBox points to shared newsletter provider

BitBox issued a similar alert after users reported receiving a phishing email that appeared to come from the company. In its warning, BitBox said its preliminary review suggested that its newsletter provider had likely been compromised. The company also noted that multiple Bitcoin companies seemed to have been targeted through a shared provider, suggesting that the attackers may have gained access to a common vendor used by several firms in the sector.

Shared service providers are common in the cryptocurrency industry. Companies often use third-party platforms for email marketing, customer support, shipping notifications, and other communications. When one of those providers is breached, the attackers can send messages that look like they originate from the affected companies. Because the emails may pass authentication checks and come from a trusted domain, recipients are more likely to open them and follow instructions.

BitBox's warning did not indicate that its hardware devices had been compromised. The issue described by the company involved email communications, not the firmware or private key storage of its wallets. That distinction matters for users: a phishing email can be dangerous even when the underlying device remains secure. The goal of the attackers is to trick the user into voluntarily giving up sensitive information, not to break the device through a technical exploit.

Recent security incidents add to concerns

The phishing warnings follow a series of recent security disclosures across the hardware wallet sector. On August 13, a breach at Trezor's shipping provider, ShipMonk, exposed data belonging to nearly 14,000 customers. On September 4, Trezor disclosed that another 67,000 US customers were affected. The compromised information in a shipping breach may include names, addresses, phone numbers, and order details. That data can be used for targeted phishing, social engineering, and physical threats.

In July, BitBox said its devices were unaffected by a vulnerability involving Coldcard's random-number generation. Random-number generation is a critical component of any hardware wallet, because weak randomness can undermine the security of private keys. BitBox's statement was intended to reassure users that its own devices did not share the flaw. In August, BitBox released an update fixing two severe firmware vulnerabilities. The company said there was no known exploitation and no reported stolen funds at the time.

These incidents show that hardware wallet security is not limited to the physical device. It also depends on the security of firmware, random-number generation, shipping partners, email providers, newsletter platforms, and customer support systems. Attackers can probe any of those areas. A weakness in a third-party service may not expose private keys directly, but it can provide the information and credibility needed to launch a convincing phishing campaign.

Why hardware wallet phishing is effective

Hardware wallet users are often targeted because they are known to hold valuable crypto assets. Attackers may assume that anyone who owns a hardware wallet has a meaningful balance and is therefore worth the effort. The devices themselves are designed to keep private keys offline, which makes remote theft difficult. Phishing sidesteps that protection by targeting the person instead of the machine.

Urgency is a common tactic. A message that warns of a critical vulnerability, an account suspension, or a pending security update can push users to act quickly without verifying the sender. If the email appears to come from a trusted hardware wallet company, the sense of urgency is even stronger. Attackers may also reference real events, such as the recent shipping breaches or firmware disclosures, to make the message seem current and credible.

The fake STM32 entropy vulnerability alert fits that pattern. It uses technical jargon that sounds plausible to crypto users. It implies that the user's device may be at risk. It then directs the recipient to click a link. For an attacker, the ideal outcome is that the user visits a fake support page and enters a recovery seed. With that seed, the attacker can restore the wallet on their own device and drain the funds.

The STM32 entropy vulnerability claim explained

STM32 microcontrollers are produced by STMicroelectronics and are used in a wide range of embedded applications. Some hardware wallets use secure elements or other chips, while others rely on microcontrollers for certain functions. An entropy vulnerability would mean that the random data used to generate keys is not sufficiently unpredictable. In theory, that could allow an attacker to derive private keys from public information or predict future keys.

Real vulnerabilities of this kind require careful disclosure. Vendors typically coordinate with security researchers, publish technical details, and release patched firmware. Users are instructed to update through official software, not through links in unsolicited emails. A genuine emergency notice might direct users to a verified app or website, but it would not ask for a recovery seed. The fraudulent message appears designed to exploit the fear of a deep technical flaw while bypassing the safeguards that legitimate advisories use.

Users should treat any unsolicited security alert as suspicious until it is confirmed through an independent channel. That means opening the official wallet app, visiting the company's website by typing the address manually, or contacting support through a known method. It does not mean clicking a link in the email, downloading an attachment, or entering a seed phrase into a web page.

Supply chain and third-party risk

The BitBox warning about a shared newsletter provider illustrates a broader challenge for cryptocurrency companies. Many firms rely on the same small set of service providers for email marketing, analytics, customer relationship management, and shipping. When attackers compromise one provider, they can potentially reach customers of multiple companies at once. The result is a supply chain attack that affects several brands without any of them suffering a direct breach of their own core infrastructure.

Shipping breaches are especially dangerous because they expose personal information that can be used to make phishing messages more convincing. An attacker who knows a customer's name, address, and order history can craft an email that references a real purchase or a real delivery. That level of detail makes the message harder to dismiss. It also raises the risk of physical attacks, such as home invasion or theft, for users who are known to hold crypto.

Hardware wallet companies have responded by warning customers, improving internal security, and in some cases changing vendors. However, third-party risk is difficult to eliminate entirely. Companies can audit providers, limit the data they share, and monitor for suspicious activity, but they cannot fully control the security practices of every vendor. Users therefore need to remain vigilant even when a message appears to come from a trusted brand.

What users should do

Users who receive a suspicious security alert should avoid clicking links or downloading attachments. They should verify the message through an official channel. For hardware wallet users, the most important rule is simple: never enter a recovery seed into a website, email form, chat message, or app that is not the official wallet software. The seed is the key to the funds, and no legitimate support agent needs it to help with a firmware issue.

Other practical steps include using unique passwords for exchange and wallet-related accounts, enabling two-factor authentication where possible, and keeping firmware up to date through official update mechanisms. Users should also be cautious about messages that create urgency, threaten account closure, or promise a security fix. If a message asks for a seed phrase, private key, or password, it is almost certainly a phishing attempt.

• Never share a recovery seed with anyone, including someone claiming to be from a hardware wallet company.
• Do not click links in unsolicited security alerts; navigate to the official website manually.
• Verify firmware updates only through the official wallet app or verified release channels.
• Use unique passwords and two-factor authentication for related accounts.
• Treat emails that reference personal data from shipping breaches as potential phishing attempts.
• Report suspicious messages to the hardware wallet company through official support channels.

Industry implications

The recent warnings and breaches may push hardware wallet makers to reassess their reliance on third-party vendors. Email providers, newsletter platforms, and shipping companies are not always subject to the same security standards as the hardware wallet firms themselves. A breach at a vendor can damage customer trust and expose users to targeted attacks, even if the wallet hardware remains uncompromised.

Regulators and industry groups may also take a closer look at how crypto companies protect customer data. Data protection laws in various jurisdictions impose obligations on companies that collect and process personal information. A breach at a vendor can still trigger notification requirements and potential liability for the company that hired the vendor. As the hardware wallet sector matures, vendor security assessments and contractual protections are likely to become more important.

For now, the immediate focus is on user education. Phishing campaigns succeed when users are caught off guard. By warning customers quickly, Trezor and BitBox have tried to reduce the chance that recipients will follow malicious instructions. The companies have also made clear that the alerts involve email services, not necessarily the security of the hardware wallets themselves.

The distinction between a device compromise and a communications compromise is crucial. A hardware wallet can remain secure even if a phishing email reaches the user's inbox. The device protects private keys from remote extraction, but it cannot protect a user who voluntarily enters a recovery seed on a fake website. That is why security advice for hardware wallet users consistently emphasizes seed protection, official channels, and skepticism toward unsolicited messages.

As the crypto industry continues to face attacks on multiple fronts, the fake security alert campaign serves as a reminder that operational security extends beyond code and hardware. It includes the vendors a company trusts, the emails a customer receives, and the habits users adopt when they feel pressured or alarmed. The warnings from Trezor and BitBox are a timely example of how quickly a third-party breach can turn into a targeted phishing threat.

Requests for further details from the companies did not receive immediate responses before publication. Users who believe they may have interacted with a phishing message should move funds to a new wallet if they entered their recovery seed, and they should contact the hardware wallet maker through official support channels for guidance.

Source: Cointelegraph News