Trezor Warns of Phishing Emails Sent From Its Legitimate Domain After Breach

Hardware wallet maker Trezor confirmed that a breach at its third-party email provider allowed attackers to send phishing emails from the company’s official domain. The company warned customers on social media that an email titled about a critical security vulnerability did not originate from Trezor and urged users not to click any links within it. Trezor said it has taken down the affected domain and is investigating how the breach occurred.

Similar Attack Hits Competing Wallet Maker

On the same day, Swiss hardware wallet company BitBox reported a comparable phishing campaign circulating under its own branding. A crypto commentator who received the fraudulent email shared screenshots showing it urged customers to update their devices due to an alleged critical vulnerability, with the email using legitimate domain names and signatures rather than the typical fake addresses seen in most phishing attempts.

Part of a Pattern of Security Incidents

This marks the latest in a series of security issues for Trezor. Just last month, the company disclosed that a breach at its shipping provider exposed personal information belonging to customers, with the affected number growing from an initial estimate of roughly 13,700 to include tens of thousands more US customers. Separately, a security research team disclosed a hardware vulnerability in one of Trezor’s devices earlier this year, though the company said no user funds were ever at risk. Similar incidents have also affected rival hardware wallet maker Ledger in past years, with exposed customer data leading to ongoing scam attempts.