Galaxy

SafePal

Security

2026

<a href="https://x.com/Trezor/status/2097786518110609620?s=20" rel="noopener noreferrer nofollow">Trezor alerted users</a> on Wednesday, September 9, 2026, about hackers exploiting its third-party email provider to distribute a bogus security notice. However, the Trezor wallet was unaffected by the attack. The criminals targeted something even harder to safeguard than a piece of software: the confidence of a user in an email from a trusted provider.The subject line of the warning read as follows: “Critical Security Alert: STM32 Entropy Vulnerability.” The message stated that Trezor engineers had discovered a design defect in STM32 chips used in its products. <a href="https://decrypt.co/377831/bitcoin-wallet-trezor-hackers-breach-email" rel="noopener noreferrer nofollow">Decrypt reported</a> that Trezor recognized the message as fake and warned readers not to click on the links.<h3 class="wp-block-heading" id="strong-a-fake-flaw-sent-from-a-real-address-strong">A fake flaw sent from a real address</h3>What made the campaign effective was not the fabricated vulnerability but the manner in which the email was received. One recipient revealed that the email came from <a rel="noopener noreferrer nofollow">help@trezor.io</a>, followed the Sendinblue campaign path, and passed the DKIM, SPF, and DMARC checks.The alert specified that one out of four devices can become compromised and that recovery phrases may not have enough randomness or entropy. This language bore a close resemblance to the issues described in the recent Coldcard attack.<a href="https://x.com/Trezor/status/2097786518110609620?s=20" rel="noopener noreferrer nofollow">Trezor reported</a> that it stopped the domain used for sending out the alerts and started probing into how the fraudsters managed to use its legitimate sending infrastructure. The company’s public alert came out right after 4:30 PM Eastern time on the 9th of September, only a few hours after its users started raising flags about the emails.<h3 class="wp-block-heading" id="strong-the-breach-may-reach-past-trezor-strong">The breach may reach past Trezor</h3>According to <a href="https://decrypt.co/377831/bitcoin-wallet-trezor-hackers-breach-email" rel="noopener noreferrer nofollow">Nick Neuman</a>, co-founder and CEO of Casa, there seems to be a similar trend occurring among users of BitBox and that a common marketing email provider may have been breached.That’s the larger issue. Wallet makers can make their devices more secure, but their brand can still be stolen through means they don’t completely manage, from email service providers to shipping companies and payment processors.<h3 class="wp-block-heading" id="strong-data-breaches-are-not-device-exploits-strong">Data breaches are not device exploits</h3>In a <a href="https://www.cryptopolitan.com/scammers-target-ledger-users-fake-letters/" rel="noopener noreferrer nofollow">previous report by Cryptopolitan</a>, it was revealed that phishing attempts against Ledger users have also found their way into physical mail. However, it should be noted that these cases are different from those of device exploits since a data breach compromises identity and contact information, while a device exploit may also put financial assets at risk.The attacks on hardware wallets that occurred in 2026 make this distinction clear. <a href="https://devtestx.safepal.com/en/blog/security-update" rel="noopener noreferrer nofollow">SafePal admitted</a> that there was an authorization error in one of its order tracking plugins that led to the exposure of data of approximately 39,798 customers, and that seed phrases, private keys, and wallet credentials of these customers were not compromised.<a href="https://trezor.io/blog/news/recent-customer-data-exposed-in-shipping-provider-incident" rel="noopener noreferrer nofollow">Trezor’s ShipMonk breach</a> eventually increased the number of affected customers to 80,689 after the company learned that the old US order records dating back from 2019 to 2021 were also stored and exposed. Similarly, in January, the <a href="https://support.ledger.com/article/Global-e-Incident-to-Order-Data---January-2026" rel="noopener noreferrer nofollow">Global-e incident of Ledger</a> also saw the exposure of the order details and contact information of its customers, with the exact number of customers not being disclosed.In its August comparison, <a href="https://memeburn.com/every-hardware-wallet-breach-of-2026-and-why-they-are-not-the-same-thing/" rel="noopener noreferrer nofollow">Memeburn</a> correctly categorized Ledger, Trezor, and SafePal under “data breaches” while identifying Coldcard as an “device exploit”. The indicated figure of 13,689 mentioned by Memeburn in reference to Trezor is, however, from before the update of Trezor on September 4.Coldcard stands apart from the rest. According to <a href="https://www.galaxy.com/insights/research/coldcard-exploit-abates-as-total-losses-climb-to-at-least-1700-btc" rel="noopener noreferrer nofollow">Galaxy Research</a> on August 14, it confirmed 190 victims directly as well as more than 86,00 affected addresses and at least $112.7 million worth of stolen 1,778.84 BTC due to flaws in the firmware. Other estimates had put the possible loss near $130 million.<figure class="wp-block-image size-large"><img width="1024" height="576" class="wp-image-310129" src="https://www.cryptopolitan.com/wp-content/uploads/2026/09/ChatGPT-Image-Sep-10-2026-10_52_23-AM-1024x576.png" alt=""><figcaption class="wp-element-caption">2026 Hardware Wallet Breaches vs. Coldcard Exploit: Victims, Data Exposure and Crypto Losses</figcaption></figure><h3 class="wp-block-heading" id="strong-leaked-context-feeds-industrialized-phishing-strong">Leaked context feeds industrialized phishing</h3>The danger in a leaked shipping list is what happens next. <a href="https://www.chainalysis.com/blog/crypto-scams-2026/" rel="noopener noreferrer nofollow">Chainalysis estimated</a> that crypto scams and fraud stole $17 billion in 2025, while impersonation scams grew more than 1,400% year over year. It also found that scams with on-chain links to AI vendors generated 4.5 times more revenue per operation than those without such links.A hardware-wallet purchase record can therefore become a targeting file. A name paired with an email, phone number, home address, and confirmation that someone owns a crypto-security device gives criminals the context to craft convincing emails, calls, letters or even physical approaches.The lesson from Trezor’s latest incident is not that hardware wallets failed. It is that the security perimeter now includes the systems around them, and attackers increasingly need only one trusted-looking message to break through.Don’t just read crypto news. Understand it. Subscribe to our newsletter. <a href="https://www.cryptopolitan.com/newsletters/?utm_source=cp&amp;utm_medium=web&amp;utm_campaign=inlineAds" rel="noopener noreferrer nofollow">It's free</a>.

Trezor warns users after hackers breach email provider to send phishing alerts

Table of Contents

Cryptopolitan_News

Other articles published on Sep 10, 2026

Kripto Para Piyasası Neden Düştü? 4 Kritik Etken

XLM price tests 200-day EMA as Stellar’s network activity hits 11.6 million transactions

Solana price holds above key EMAs as trading volume drops and rally pauses

Hyperliquid Price Prediction: Why This Whale Won't Stop Buying HYPE

Visa launches blockchain-based working capital for stablecoin fintech cards

20 More Backpack Securities Stocks Go Live on Solana

Join our free newsletter for daily crypto updates!