Trezor's mail provider was hacked, causing a flood of false security alerts

Hardware wallet manufacturer Trezor's mail service provider was compromised and the attacker used it to send false security alerts.

According to the incident description, Trezor's mail service provider had a data leak, allowing the attacker to send fake security alerts to recipients. The information currently available only indicates that the mail service provider is the aggrieved party and that its access rights are used to distribute fraudulent security messages. There is no conclusive evidence as to whether the incident involved specific wallets, funds or hardware details behind Trezor's products.

Summary of Key Information

• The leak involved Trezor's email service provider.
• The attacker used the access rights gained to send a false security alert.

The vulnerability lies in the mail service provider, not the device itself.

According to reports, the core of the incident lies with Trezor's mail service provider, a third-party agency responsible for handling the company's external communications. In the case in question, it was the service provider's account that was compromised, not the hardware wallet itself.

The identified consequences are narrow and specific: the attacker used the privileges he gained to send false security alerts to recipients. This is the only use confirmed by available information. The name of the mail service provider, the date of the incident, the method of intrusion, the number of recipients affected, the leaked data or the financial losses caused have not been disclosed, so no assumptions should be made about this. Likewise, as described here, this incident does not confirm that Trezor hardware, wallet software, private keys, or user funds were compromised, nor does it prove that they are absolutely safe. Previously, Trezor had warned users after communications-related exposures, such as a data breach in which 14,000 users received phishing alerts.

Why "security alerts" become effective decoy

Messages sent by attackers are described as false security alerts. Mastering fraudulent emails as security warnings is effective precisely because it borrows the tone users expect to hear from wallet providers, prompting recipients to take quick action rather than stopping to check carefully.

Since no specific message samples, sender addresses, embedded links, requested actions or victim account information were provided, the technical details of these specific emails could not be reconstructed. As general warning signs, phishing emails often create a sense of urgency, require credentials, or contain malicious links, but these are broad patterns rather than the exact characteristics of these specific alerts. According to consumer guidance from the U.S. Federal Trade Commission (FTC), attackers often pose as trustworthy companies and claim an account or payment problem. Trezor itself has issued separate warnings about identity fraud, including fake support numbers that appeared during phishing concerns.

How to deal with suspicious Trezor security emails

The following suggestions are general precautions and are not an official response to this incident that has not been disclosed in detail. They apply to any message claiming to be a Trezor security alert:

1. Verification through independent channels: Before taking any action, please enter the website in person to visit the official channel to verify any alerts, and never click on the link in the email.
2. Risk avoidance actions: Do not click on links and attachments in suspicious emails, and under no circumstances do you disclose wallet recovery mnemonic or private key when replying to emails.
3. Rational judgment: Receiving an email does not in and of itself prove that funds have been embezzled, nor should funds be transferred based solely on an alert. Fraudulent approval patterns that emerge in cases such as the "fake anti-money laundering (AML) checker" suggest that unsolicited action prompts merit independent verification.

For Bitcoin holders, this incident reminds us that the security of self-custody depends on the integrity of the signing device and the confidentiality of mnemonic words. Even if a vendor's peripheral systems are compromised, both are still controlled by users. The Bitcoin network's own settlement guarantee is based on proof of work and is independently verified by each full node, and is not affected by the intrusion of corporate mail service providers.