Trezor Users Targeted by Phishing Campaign Following Third-Party Data Breach

Security Breach at Shipping Partner

Hardware wallet manufacturer Trezor has confirmed that a recent wave of phishing emails targeting its user base originated from a third-party data breach. According to The Block, the incident occurred at ShipMonk, a shipping provider used by the company. Trezor emphasized that its own internal systems and infrastructure were not compromised during this event. Instead, the attackers gained access to customer contact details held by the third-party vendor, which they subsequently utilized to craft targeted fraudulent communications.

Phishing Tactics and False Claims

The phishing campaign involves emails sent from what appears to be a legitimate domain, designed to deceive users into believing their hardware wallets are at risk. Cryptopotato reports that these messages falsely claim that 25% of all Trezor devices are currently vulnerable to a security exploit. The emails typically urge recipients to take immediate action to secure their funds, often directing them to malicious websites intended to harvest sensitive information or private keys.

Industry-Wide Warnings

The scope of these fraudulent alerts has prompted broader industry concern. Cointelegraph notes that both Trezor and BitBox have issued formal warnings to their respective communities regarding these deceptive security notifications. Users are being cautioned to remain vigilant against any unsolicited emails requesting urgent security updates or device verification.

Security experts and the affected companies reiterate that hardware wallet providers will never ask users to input their recovery seeds or private keys into a website. Because the data breach involved contact information, users should be particularly wary of any communication that addresses them by name or references their purchase history. As the situation develops, users are encouraged to verify all security alerts directly through official company channels and avoid clicking links provided in suspicious emails. The incident highlights the persistent risks associated with third-party data exposure, even when the primary service provider maintains robust internal security protocols. Trezor continues to monitor the situation and has advised its customers to exercise heightened caution until the threat is fully mitigated.