Trezor and BitBox issued fresh phishing warnings after customers received fraudulent emails that appeared to originate from the hardware wallet companies’ communication channels.
Both companies told users to avoid unexpected security messages, especially those that direct recipients to external links.
The incidents surfaced Wednesday and, based on the companies’ preliminary assessments, appear to involve outside email or newsletter infrastructure rather than compromises of the wallets themselves.
Trezor and BitBox Investigate Email-Service Incidents
Trezor attributed its campaign to a security incident affecting a company it uses for email delivery. The breach allowed attackers to send emails that appeared to come from Trezor.
Among the fake messages was an email carrying the subject “Critical Security Alert: STM32 Entropy Vulnerability.” Trezor identified the notice as fraudulent and warned customers not to click any links in the email.
BitBox disclosed comparable activity later that day, saying some customers had received messages crafted to resemble official company communications.
The company’s early findings focused on the service used to distribute its newsletter. BitBox said the same infrastructure may also have been involved in phishing aimed at other Bitcoin businesses, raising the possibility that several firms were being targeted through a common external vendor.
Neither company described the latest incidents as evidence that attackers had penetrated its hardware wallets.
Earlier Disclosures Add Context to Latest Warnings
The phishing alerts follow a series of unrelated security disclosures involving Trezor, BitBox, and companies that provide services for their products.
Trezor reported in August that information associated with close to 14,000 customers had been exposed through ShipMonk, a third-party fulfillment company. A subsequent disclosure in early September expanded the affected population by about 67,000 U.S. customers.
Those exposures concerned information stored by an outside service rather than data taken from Trezor hardware. The new email campaign likewise centers on infrastructure operated beyond the wallet itself.
BitBox has faced separate security concerns. In July, it responded to concerns over a Coldcard entropy-generation flaw, saying BitBox products were not affected by the vulnerability.
The following month, BitBox published fixes for two significant firmware weaknesses. At the time of the disclosure, the company said it was unaware of any exploitation of the vulnerabilities or any related loss of user funds.
However, the current Trezor and BitBox warnings are centered on social-engineering emails, not confirmed breaches of their wallet devices.
Customers are being advised to treat unexpected security messages cautiously and to verify unusual requests through official company channels before taking action.