TREZOR EMAIL BREACHED — THE STM32 ALERT IN YOUR INBOX IS A PHISH

Reader safety, then back to the tape. Trezor said at about 4:30 PM ET that its third-party email provider was breached and that an email titled “Critical Security Alert: STM32 Entropy Vulnerability” is not from Trezor. It is a phishing attempt. Do not click any link in it.

If you already clicked and typed your recovery words into a page, treat that seed as gone. Move the funds to a new wallet with a new seed now, from a device you trust, and do not reuse the old words anywhere.

There is no STM32 entropy bug being fixed by a link. A hardware wallet’s seed never goes into a browser, a form, an app, or an email, for any reason, from anyone. That rule is the whole product. The attacker cannot reach the chip, so he reaches the inbox.

This is Trezor’s third vendor failure in four weeks, after the August breach at its shipping partner and the 2024 support-portal breach. Same lesson each time: the company’s vendors know who you are and where you live, and the device is only as private as the last form you filled in.

At the time of this writing, bitcoin was $78,219 at 7:42 PM ET on Crypto.com.