Loading story…
Trezor warned customers that attackers who compromised a third-party email provider are sending phishing messages from help@trezor.io. The emails masquerade as urgent security notices and falsely claim an STM32 microcontroller entropy flaw exposes wallet seed phrases to brute-force recovery. Trezor said its own systems were not breached, disabled the phishing domain, and is investigating the provider compromise and the attackers' use of its legitimate email domain; BitBox users were also reportedly targeted through a similar provider-related campaign.
The lure exploits concern over genuine hardware-wallet entropy issues, including a Coldcard Mk3 firmware flaw reportedly linked to theft of roughly 594 BTC from about 500 addresses. Trezor customers also face heightened social-engineering risk after logistics contractor ShipMonk exposed order data for approximately 81,000 customers in a separate breach reportedly tied to a critical Metabase SQL-injection zero-day. Organizations and users should treat unsolicited wallet-security emails as malicious, avoid embedded links, and verify notices through official channels.
Get the infrastructure and lures behind it.
14 events from the most recent confirmed update back to the earliest known activity.
Brevo identified the security issue in its SAML single-sign-on handling. Its postmortem said six compromised customer accounts were used to send phishing emails and contact lists were exported from 43 accounts, potentially enabling further targeted phishing.
Trezor warned customers that attackers who breached its third-party email provider were sending phishing emails from help@trezor.io, falsely alleging an STM32 entropy vulnerability. Trezor disabled the campaign domain, advised users not to follow links, and began investigating the provider breach and access to its legitimate domain.
Trezor disclosed that approximately 67,000 additional U.S. customers were affected by the ShipMonk breach, bringing the total impact to about 81,000 customers. The additional exposed records concerned orders from November 2019 through August 2021 and included names, addresses, phone numbers, and order numbers.
Trezor learned that ShipMonk still retained older customer records despite prior assurances that the data had been deleted.
Trezor disclosed unauthorized access at logistics contractor ShipMonk affecting 13,689 customers. Exposed data included names, postal and delivery addresses, phone numbers, email addresses, cities, and order information; Trezor said its own systems, wallets, private keys, and seed phrases were not compromised.
Metabase said threat actors had exploited a critical SQL-injection zero-day in customer instances, obtaining administrator access and stealing data. Breach notifications indicated this vulnerability was used in the ShipMonk compromise.
Attackers exploited a Coldcard Mk3 firmware build-configuration error that caused use of a software pseudorandom generator, creating vulnerable recovery seed phrases. On July 31, they withdrew approximately 594 BTC, worth about $38 million, from roughly 500 addresses.
BitBox said its hardware wallets were not vulnerable to the entropy issue affecting certain Coldcard devices.
Trezor disclosed that attackers had compromised its third-party support-ticketing portal, exposing names, usernames, and email addresses of roughly 66,000 users.
Brevo said attackers accessed 138 accounts and exploited an authorization-scoping flaw that improperly granted access to all organizations reachable by compromised accounts. The flaw was used to send phishing messages, including those targeting Trezor customers.
Trezor reported that 347,000 customers received Brevo-sent phishing emails impersonating a critical STM32 entropy alert, and approximately 2,500 clicked the malicious link. Trezor took the credential-harvesting site offline 20 minutes after detecting it; any resulting cryptocurrency losses remain unknown.
CoinTracking said its customers received a malicious API-key-reset phishing email and identified Brevo as the compromised email provider. Brevo said an attacker abused 120 customer accounts to send phishing messages to client contact databases and that it had closed the attacker's access.
BitBox issued a similar phishing warning, saying preliminary information indicated its email provider had been compromised and that other Bitcoin companies using the same provider were also affected.
Further affected addresses and stolen funds were identified after the initial Coldcard theft. Coinkite released firmware fixes, although owners of vulnerable seed phrases still needed to generate new phrases and move their funds.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
7 references tracked. Mallory keeps watching after this page renders.
malwarebytes.com
Open sourcetechcrunch.com
Open sourcesecurityweek.com
Open sourcexakep.ru
Open sourcebleepingcomputer.com
Open sourcetherecord.media
Open sourcetrezor.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Trezor confirmed that a breach at fulfillment provider ShipMonk exposed historical order and personal data for roughly **67,000 additional U.S. customers**, bringing the total affected population to more than 80,000. The records relate to orders placed from November 2019 through August 2021 and include names, email addresses, phone numbers, shipping addresses, and order numbers. Trezor said its own systems, hardware wallets, wallet backups, and parcel-content details were not compromised. Attackers reportedly gained access by exploiting `CVE-2026-72898`, a critical SQL-injection zero-day in the Metabase analytics platform that could enable administrator-level access. Halborn attributed the incident to the ShinyHunters extortion group. Trezor said ShipMonk retained data that it had represented as deleted or anonymized, and warned impacted customers to expect phishing, impersonation, fraudulent calls or letters, and heightened physical-security risks tied to hardware-wallet ownership.
Sep 11, 2026
Trezor disclosed that unauthorized access at third-party logistics provider **ShipMonk** exposed customer order data for **13,689** hardware wallet buyers, affecting recent deliveries across the **U.S., U.K., Sweden, Colombia, Brazil, Italy, and Portugal**. The exposed information included full names, email addresses, phone numbers, and shipping addresses for **11,742** customers, while **1,947** others had more limited data exposed, such as name, city, and email address. Trezor said ShipMonk notified it of the incident after attackers accessed systems containing order records tied to shipments delivered between **May 10 and Aug. 8, 2026**. Trezor said its own infrastructure, wallets, devices, and firmware were **not compromised**, but warned affected customers to expect phishing, impersonation, and possible physical-security risks because the leaked data links identities to hardware wallet purchases. The company said its **90-day data retention policy** limited the scope because older records had already been deleted or anonymized, and it has notified impacted users by email while working with ShipMonk as the provider secures and hardens affected systems. Trezor also said it plans to roll out an **Anonymous Delivery** option, first in the EU and later in the U.S., to reduce future customer exposure.
Sep 4, 2026
Coinkite disclosed an ongoing security incident in which vulnerable **COLDCARD** firmware generated wallet seeds with weak entropy, allowing attackers to reproduce seeds offline and steal funds. The company said a build and link integration error during its `libNgU` migration caused seed generation to use MicroPython’s non-cryptographic **Yasmarang** PRNG instead of the intended hardware true random number generator, despite `MICROPY_HW_ENABLE_RNG=0` being meant to disable the software path. Coinkite halted shipments, destroyed remaining affected inventory, released patched firmware for newly generated seeds, and warned that seeds already created on vulnerable devices remain at risk; **SATSCARD, OPENDIME, and TAPSIGNER** were not affected. External reporting said the exploitation began rapidly, with Galaxy Research estimating attackers drained **1,367 BTC**—about **$88.6 million**—from **4,385 addresses** across multiple attack waves after an initial 41-minute sweep of 1,082.65 BTC from 1,196 addresses. Coinkite urged users who created seeds on affected firmware without at least **50 independent private dice rolls** and a strong unique **BIP-39 passphrase** to move funds to a new wallet immediately, while preserving affected devices for possible recovery and law-enforcement action. The company also temporarily suspended its normal 120-day customer data blanking process to preserve records for ongoing and anticipated legal proceedings, while allowing customers to request exemption from that retention protocol.
Aug 12, 2026