Trezor data breach widens; phishing emails sent from official domain

Trezor is warning users about phishing emails sent from its own official domain after its email provider was breached. The hardware wallet maker says recipients should not click any links claiming a “STM32 Entropy Vulnerability,” which is not a real issue.

This follows news that the Trezor data breach is larger than first disclosed, with an additional 67,000 U.S. customers who ordered between November 2019 and August 2021 now known to be affected. No devices or wallet credentials were compromised in either incident, but affected users face elevated phishing risk, and the phishing emails reinforce warnings to stay on guard against scams impersonating Trezor.

• Email provider breach allows phishing from Trezor's official address.
• Users advised to ignore “STM32 Entropy Vulnerability” links.