Trezor and BitBox Phishing Attack Spreads Through Shared Email Provider

Points of Focus

• Trezor confirmed a breach involving its third-party email provider.
• BitBox traced similar phishing emails to a likely newsletter-provider compromise.
• Some phishing emails passed normal sender checks before directing users to fake security tools.

Trezor and BitBox users were targeted on Sept. 9 by phishing emails falsely claiming entropy vulnerabilities threatened their hardware wallets. 

Trezor confirmed a breach involving Brevo, its third-party email provider, which processes subscriber email addresses and, in some cases, names. The company has not disclosed whether attackers accessed or exported that subscriber data.

BitBox said its preliminary investigation pointed to a likely compromise at a newsletter provider shared by several Bitcoin companies.

Trezor confirms provider breach after fake security alert

Trezor warned users in a X post that an email titled ‘Critical Security Alert: STM32 Entropy Vulnerability’ was fraudulent. The company said it took down the malicious domain and began investigating how attackers gained access to its legitimate domain.

Our third-party e-mail provider has been breached. Please be aware that the email named ‘Critical Security Alert: STM32 Entropy Vulnerability’ is not coming from us, and it’s a phishing attempt. Do not click on any link.

We have taken down the domain, and we are investigating…

— Trezor (@Trezor) September 9, 2026

The phishing claim resembled a real randomness flaw disclosed in July that affected certain Coldcard firmware versions. Trezor explained in an August update that wallets originally generated on its devices weren’t affected by that flaw. The Sept. 9 campaign instead used a supposed entropy problem to push Trezor users toward a fake security check.

BitBox points to shared newsletter provider

BitBox reported a similar campaign targeting newsletter subscribers. In an update, the company said it was “very likely” its newsletter provider had been compromised and that several targeted Bitcoin companies appeared to share the same provider.

BitBox contacted the provider, warned subscribers and reported the phishing domains. Most identified links were taken down, but the company said on Sept. 10 that technical limitations prevented its follow-up warning from reaching every subscriber.

Our preliminary review of the phishing mail that was sent out to our newsletter subscribers about an hour ago found that it is very likely that our newsletter provider got compromised.

Multiple other Bitcoin companies got targeted as well, and it appears that we all share the…

— BitBox (@BitBoxSwiss) September 9, 2026

Phishing emails passed normal sender checks

Trezor forum users posted email headers showing messages arriving through mailing.trezor.io. One recipient also reported successful SPF, DKIM and DMARC checks, which help mail services verify whether messages are authorized to use a domain.

The apparent authentication made the emails harder to reject based on the sender alone. Trezor’s security guidance says it will never ask users to enter or share a wallet backup through an emailed request.

The incident is separate from Trezor’s August ShipMonk breach, which exposed data belonging to more than 80,000 customers. Trezor hasn’t linked that dataset to the Sept. 9 phishing campaign. On Sept. 10, Trezor identified Brevo as the third-party email provider involved in the latest incident.