Trezor, maker of the popular Model T and Safe hardware wallets, told customers Wednesday that attackers have breached its third-party email provider and are sending phishing emails to registered users. The fake messages appear to arrive from help@trezor.io—a legitimate Trezor email address—making them harder to spot than typical impersonation attempts sent from lookalike domains.
The phishing emails claim that a “hardware microcontroller vulnerability” in the STM32 microcontrollers used by Trezor wallets could expose the user’s recovery seed to brute-force cracking. They instruct recipients to follow a link and enter their 12- or 24-word seed phrase to “safeguard” their funds. Entering the seed phrase would give the attacker complete, irrecoverable access to everything in the wallet. Trezor said it has taken down the domain linked in the emails and is investigating how the attackers obtained access to send mail from its own domain.
Your seed phrase is the master key to your wallet. No legitimate message from Trezor—or any hardware wallet company—will ever ask you to type or paste it anywhere.
This incident is unrelated to the earlier Shipmonk supply-chain breach that exposed customer shipping records earlier this year. This is a separate compromise of Trezor’s email infrastructure.
How to check if you’re affected
Affected products include all Trezor hardware wallet models whose registered email address was stored with Trezor’s email service provider. If you have ever created a Trezor account or registered a device, assume your email address may have been exposed.
- Delete any email purporting to be from Trezor that asks for your seed phrase, wallet passphrase, or PIN.
- If you clicked the link in such an email but did not enter your seed phrase, you are likely safe. Close the page and do not return to it.
- If you entered any part of your seed phrase on a site reached through a Trezor email, move your funds immediately to a new wallet generated on a device that has never been connected to the internet. Treat your existing wallet as fully compromised.
- Trezor’s real support operates at trezor.io/support—verify any communications there before taking action.