Today’s Field Note

Trezor confirmed a breach at its third-party email provider, and attackers are using the legitimate Trezor domain to send fake “Critical Security Alert: STM32 Entropy Vulnerability” emails aimed at coaxing recovery phrases out of users. This is the third backend incident for Trezor in roughly two months (ShipMonk shipping data last month, now email), and BitBox says the same shared newsletter provider hit multiple Bitcoin firms. The hardware and firmware have not failed. The vendors around them keep doing so, which means the attack surface is your inbox, not your device. Separately, the US sanctioned the Xinbi marketplace and restrained $52M in crypto, with DOJ pursuing 47 more wallets, so laundering-adjacent counterparties are worth a fresh look.

Today’s Move

  • Treat any email citing an “STM32 Entropy Vulnerability” or urgent recovery-phrase action as phishing, even if it comes from a genuine Trezor or BitBox address. Do not click.
  • Never enter your seed phrase anywhere except directly on the device. No legitimate alert will ever ask for it via email or web.
  • Assume your email and shipping details tied to hardware wallet purchases are now in circulation. Watch for tailored spear-phishing referencing your real order.
  • Verify firmware and any advisories only through the official Trezor Suite app or the vendor’s site typed manually, not through email links.
  • If you interact with OFAC-sensitive flows, screen counterparties against the newly sanctioned Xinbi wallets before moving funds.

Resources

  • https://www.bleepingcomputer.com/news/security/trezor-warns-users-of-email-provider-breach-phishing-attacks/
  • https://www.theblock.co/news/defi/2026-09-09-trezor-phishing-emails-414086
  • Incident trackers (reference standard): Rekt leaderboard · SlowMist Hacked

More: Issues · Field Notes · RTFM

Daily field notes, weekly Issues. Follow @ItsAlreadyPrice or subscribe via RSS.