Trezor warns of phishing email after email provider breach

Trezor's third-party email provider was breached, and a fake email with a subject about an STM32 entropy vulnerability is being sent in the brand's name. This is phishing: the email is not from Trezor, and its links may lead to a malicious website. The vendor has already disabled the domain used and is investigating how the attackers gained access to it.

Actions to take

Do not open the email with the subject about an STM32 entropy vulnerability or follow its links — it is phishing, rather than a message from Trezor; if in doubt, check information only through the vendor's official account.

Source: x.com - Trezor

Incident history

09 SeptTrezor warns of phishing email after email provider breach
10 SeptTrezor: phishing email led to an app requesting wallet backups; about 2,500 people opened the link