Hardware wallet providers Trezor and BitBox have issued urgent warnings to users about phishing emails linked to suspected compromises of third-party email services, raising concerns over cybersecurity risks in the cryptocurrency sector.
Trezor attributed a fraudulent email titled “Critical Security Alert: STM32 Entropy Vulnerability” to a breach at its shipping provider, ShipMonk, which exposed data of nearly 14,000 customers in August. The company also reported a separate incident on Sept. 4 affecting an additional 67,000 US users, though details of this breach remain unclear.
BitBox separately warned users of phishing attempts tied to a potentially compromised newsletter provider, with multiple Bitcoin companies reportedly targeted through a shared service. The firm released a firmware update in August to address two severe vulnerabilities, stating no exploitation or stolen funds had been confirmed.
Coldcard, another hardware wallet maker, was mentioned in relation to a random-number generation vulnerability, but BitBox clarified its devices were unaffected. Both companies urged users to verify email sources and avoid clicking on unsolicited links.
The exact scope of the phishing campaign and the identity of the compromised newsletter provider remain unconfirmed, with no official responses provided by Trezor or BitBox to external inquiries.
Written by Daniel Brooks
Security Desk
