A horse in the ramparts. On September 9, 2026, Trezor customers received an email with the correct logo, at the correct address, announcing a critical flaw in the STM32 chips that equip their hardware wallets. Nothing is wrong, except that everything is wrong. The Czech manufacturer is just emerging from its data leak at its logistics provider ShipMonk. This leak exposed the contact details of tens of thousands of customers. This time, it was its email service provider who gave in, letting attackers write from the brand's official address.
STM32 Entropy Vulnerability: the fake flaw that trapped Trezor clients
The email is titled “Critical Security Alert: STM32 Entropy Vulnerability”. Concretely, he claims that an entropy flaw, or a defect in the random generation of keys, affects the STM32 chips which equip a good number of Trezors in circulation. The message pushes the reader in a hurry to click on a link to “secure” their balance. The link takes you to an application to download, which then requests the 12 or 24 word recovery phrase. Result: the entire wallet goes up in smoke, because this sequence of words alone allows any associated private key to be reconstructed.
The sender makes this trap formidable, much more than the technical pretext, which is rather crude for those who know a little about the subject. The email passes all SPF, DKIM and DMARC authentication checks, checks that are supposed to confirm that an email comes from the correct domain. It actually comes from Trezor's Brevo account, not its internal servers, which is why it passes all filters. On Do not click on any links,” reports The Block. Trezor had the fraudulent domain closed in just 20 minutes, but around 2,500 people had already clicked on the link among the approximately 347,000 subscribers targeted by the mailing.
“Our third-party email provider was the victim of a cyberattack. Please note that the email titled “Critical Security Alert: STM32 Entropy Vulnerability” did not come from us and is a phishing attempt. Do not click on any links. We have disabled the affected domain and are currently investigating the situation, including how the hackers gained access to our legitimate domain.”
Brevo, the weak link that also trapped BitBox and CoinTracking
Trezor is not alone in this story. The compromised service provider is none other than Brevo, a platform for sending marketing emails which was called Sendinblue until 2023. Dozens of companies use it for their newsletters. As a result, at least two other crypto players suffered the same mishap on the same day.
Brevo acknowledged a security incident which allowed an attacker to access 138 accounts on the platform, including 6 used to send phishing and 43 having undergone an export of contacts. Swiss manufacturer BitBox spotted an identical campaign targeting its own users. “Several other bitcoin companies have been targeted and appear to have used the same service provider,” he admitted, according to Bitcoin.com. CoinTracking, the crypto portfolio tracking and tax service, has asked its users not to click on any links until the investigation is complete.
Third alert in a month: the black series of Trezor providers
Let's go back a little. In mid-August 2026, Trezor already announced a leak from its logistics provider, ShipMonk: names, postal addresses and telephone numbers of 13,689 customers exposed. At the beginning of September, the brand had to revise its copy upwards. the same breach actually affected 67,000 additional US customers, bringing the total to 80,689 people. However, this leak did not directly compromise any keys, wallets or backups. But postal and telephone details in the wrong hands quickly translate into fraudulent calls and parcel bombs.
Add the Brevo breach to this picture and the tally is quickly made: two different service providers, three security incidents, in less than a month. Trezor hardware has never been questioned. Fourth week only.
