The Sender Checks Passed. One Hacked Newsletter Vendor Sent Trezor, BitBox, and CoinTracking Users a Fake Seed Alert

What Happened

Late on Wednesday, September 9, an email titled 'Critical Security Alert: STM32 Entropy Vulnerability' reached subscribers to Trezor's mailing list. It came from Trezor Security at help@trezor.io with a return path on mailing.trezor.io, was sent through the campaign infrastructure of Sendinblue, now Brevo, and passed the Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting and Conformance (DMARC) checks that catch spoofed senders, according to headers recipients posted to the Trezor forum and reporting by PANews.

The message said Trezor engineers had found a 'critical hardware-level vulnerability' in the STM32 microcontrollers inside its devices, a factory defect affecting roughly 1 in 4 units and producing recovery seeds with as little as 40 bits of randomness. It linked to a 'check if you're affected' page on r.

mailing.trezor.io, a click-tracking subdomain within Trezor's own mailing setup, per Blockonomi. Some variants reportedly asked for the wallet's extended public key (xpub); the page's purpose, per Cointelegraph, was to collect wallet information or recovery words.

Trezor posted at 20:37 UTC: 'Please be aware that the email named Critical Security Alert: STM32 Entropy Vulnerability is not coming from us, and it's a phishing attempt. Do not click on any link.' It said its third-party email provider had been breached, that the domain used in the attack was down, and that it was investigating how the attackers got access to its legitimate domain.

Keys and recovery backups were not exposed. About an hour after its own subscribers received a 'Microcontroller Entropy Vulnerability' variant, BitBox said it was 'very likely that our newsletter provider got compromised' and that 'multiple other Bitcoin companies got targeted as well, and it appears that we all share the same newsletter provider.'

Blocktrainer, the German Bitcoin outlet, reported that the wave also reached CoinTracking, the portfolio and tax tracker, and that unauthorized application programming interface (API) keys had been created inside the affected companies' accounts at Brevo; Casa chief executive Nick Neuman reached the same conclusion.

Neither wallet maker has named the provider, said how many subscribers received the mail, or reported a confirmed loss as of Thursday morning.

The signature was real, the domain was real, and the alert was written by the last real flaw. When the pipe itself is compromised, the only check left is the one you run by typing the address yourself.

The Checks Passed Because the Sender Was Real

Trezor's own phrasing, that it is investigating how the attackers got access to its legitimate domain, is the whole incident. A company that sends newsletters delegates a subdomain such as mailing.trezor.io to an email service provider (ESP), which signs outgoing mail for that domain and rewrites every link through a tracking subdomain, here r.

mailing.trezor.io, so clicks can be counted. Whoever holds a sending key at the ESP inherits the entire arrangement: the domain, the DKIM signature, the tracking links, and the subscriber list. Nothing was spoofed on Wednesday. The phish was a Trezor campaign in every property a mail client can inspect, which is why the 3 habits users are drilled on, checking the sender, hovering the link, and looking for the real domain, all returned 'genuine.'

The attackers did not imitate Trezor's domain. They used it.

For Trezor the pattern is old. Its newsletter provider at the time, Mailchimp, was compromised in March 2022 and pushed a fake Trezor Suite update to customers; its third-party support portal leaked 66,000 users' contact data in January 2024, and seed-phishing followed. Each time the channel, not the device, carried the attack, and this is the 3rd contractor disclosure in 4 weeks: fulfillment partner ShipMonk's breach, disclosed on August 13 at 13,689 customers, grew on September 4 to roughly 80,700.

The hardware has held every time. What is new is the concentration. A meaningful slice of the Bitcoin hardware wallet industry runs its customer mail through 1 marketing vendor, so 1 set of API keys reached several companies' lists inside the same hour. This site's August 4 piece predicted near-identical emails for Trezor and BitBox owners the next time any vendor shipped an advisory.

The attackers did not wait for one. They wrote it.

The Coldcard Flaw Wrote the Script

Nearly every technical detail in the phish was borrowed from a real event. Since July 30 an attacker has swept roughly 1,800 BTC, more than $110 million, from thousands of addresses whose seeds came from Coinkite's Coldcard, where a 2021 build error let seed generation fall back to a weak software random number generator; TRM Labs put the effective strength of some seeds at 40 bits.

'Entropy,' '40-bit seeds,' a factory-era defect in a common chip, a fraction of devices affected: the phish is a paraphrase of 6 weeks of true headlines, aimed at readers who spent those weeks learning that hardware wallets can generate bad seeds. The claim is false for the targets.

Trezor's documented design combines 256 bits from the STM32's hardware generator with 256 bits supplied by the connected computer, so a single weak source cannot collapse the seed, and since firmware 2.8.7 Trezor Suite verifies during setup that the device mixed both. BitBox published in August that its design is not affected by the Coldcard issue.

None of that helps the recipient, and that is the design. Nobody audits a vendor's entropy pipeline from an inbox, and the correct response to a real seed flaw is to generate a new seed on the device and move funds to it. That is precisely the motion a phishing page needs a victim to begin: worried holder, existing seed in hand, ready to migrate.

The fair objections deserve their space. The vendors caught this in about an hour, the domain came down, no loss has been confirmed, and a company that runs its own mail servers instead of a specialist provider is usually less secure, not more. All true. The defense worked for everyone who waited 60 minutes.

It offered nothing to whoever acted in the first 10, and 6 weeks of Coldcard coverage trained exactly that reflex.

What This Means for You

If you received either email, do nothing with it. If you clicked and typed recovery words or a passphrase into the page, treat that seed as burned: create a new wallet on the device, move every balance to it now, and assume the old addresses are watched. If you entered only an xpub, no funds can be taken with it, but the attacker can now watch every address and balance in that wallet; move funds when convenient and expect targeted follow-ups.

Do not wait for a vendor to tell you whether you were affected, because the next message offering to check is the same attack with a different subject line.

Then rewrite 2 rules. First, authentication is a property of the pipe, not the author. A passing DKIM or SPF check means a message left through the vendor's provider; it says nothing about who typed it, and a link on the vendor's own subdomain proves nothing when the provider hosts the link.

Second, no security advisory ever needs a link, and no remediation ever happens on a web page. A real seed flaw is fixed on the device, new seed and migration, and the only place recovery words are ever entered is the hardware itself. Verification runs one way: open a browser, type trezor.

io or bitbox.swiss, and read the timestamped notice. Vendors have a version of this rule to adopt too: an advisory that ships through a marketing ESP is an advisory an ESP key can forge, and a vendor's own app and signed blog are channels a stolen sending key cannot reach.

Now shrink the surface, and name the limit. Self-custody put you on these lists. Buying signing hardware creates a record at the vendor, its fulfillment partner, and its email provider, and 2 of those 3 have failed for Trezor customers in 4 weeks. A custodial account does not spare you, since exchanges get phished through their providers too, but no device feature fixes an inbox.

So unsubscribe from every wallet vendor's marketing list; the newsletter is the channel. Use a distinct email alias per vendor so a leak names its source. And put something between a phished seed and the savings: a BIP-39 passphrase, which turns 12 or 24 surrendered words into an empty decoy, or multi-sig, in which no single seed spends.

The seed stays safe exactly as long as it never leaves the device. The list of who owns one sits with a marketing vendor you never chose, and Wednesday showed how much of it moves with 1 key.

What to Watch

The first checkpoint is whether Trezor, BitBox, or CoinTracking names the provider and publishes a root cause. API keys created inside customer accounts can mean stolen vendor credentials, a reused password, or a breach on the provider's side, and each implies a different fix; whether Brevo confirms an incident will show which it was.

Watch for the first confirmed loss, and for the subscriber counts neither vendor has disclosed. Whether either wallet maker moves security advisories into its own app will show whether the lesson landed. And the August 15 question stands: the ShipMonk dataset of roughly 80,700 Trezor buyers has not surfaced publicly, and a mailing list joined to a shipping list is the profile the next campaign would want.

Tracked entities this report names, with total coverage across the archive. Follow one into the Actor Network to see every report it appears in.

Other reports that name the same tracked actors — a different thread than “related,” which follows wording. These are linked by who appears in them.