Trezor, BitBox warn users about fake hardware wallet security alerts

Hardware-wallet manufacturers Trezor and BitBox warned customers about phishing emails disguised as urgent security notices after apparent compromises of third-party mailing services. Both companies urged caution and indicated the messages were not legitimate communications from their teams. Trezor said on Wednesday that its email provider had been breached and identified a fraudulent alert titled "Critical Security Alert: STM32 Entropy Vulnerability." The company cautioned recipients against clicking any links in that message. No further technical details or remediation steps were provided in the initial notice. BitBox issued a separate warning after users received a phishing email purporting to come from the company. In a preliminary review, BitBox said its newsletter provider was likely compromised and suggested that several Bitcoin-related firms may have been targeted through the same service, though it did not list other affected companies. The alerts follow a string of security disclosures affecting the hardware-wallet ecosystem. On Aug. 13, a breach at shipping provider ShipMonk exposed data for nearly 14,000 customers, and on Sept. 4 Trezor reported that an additional 67,000 U.S. customers were impacted. BitBox has previously said its devices were not affected by a Coldcard random-number generation vulnerability in July and released an August firmware update addressing two severe bugs; the company reported no known exploitation or stolen funds. Cointelegraph contacted both Trezor and BitBox for more information but had not received responses before publication. Users are being advised to verify any unexpected security notices directly with device makers through official channels and avoid following links in unsolicited emails.