Trezor Email Provider Breached; 81,000 Hit by Prior Leak

81,000 Trezor customers have now had order data exposed in the August breach at logistics provider ShipMonk, after the company revised its first estimate of roughly 13,689 upward in early September. On 9 September 2026, Trezor said attackers had separately breached a third-party email provider and used it to push out a fake warning titled 'Critical Security Alert: STM32 Entropy Vulnerability' — a message engineered to get recipients to type in the recovery phrase that controls their coins.

What Trezor said about the email breach

According to BeInCrypto, Trezor said attackers breached its third-party email provider and sent customers a phishing message disguised as a critical chip security alert, that the company has taken down the domain used in the campaign, and that it is investigating how the attackers were able to send from its legitimate domain. Trezor said wallets, private keys and recovery backups stored on devices were not exposed. Trezor has not publicly named the email provider.

Two terms in the lure are worth decoding, because the fake alert borrows real vocabulary. STM32 is the family of microcontroller chips used inside Trezor devices. Entropy is the randomness a wallet uses when it generates a recovery phrase; weak entropy would, in theory, make a backup guessable. Pairing a genuine chip name with a genuine cryptographic concept is what makes the email read as technical rather than fraudulent.

One correction to how this story is being framed elsewhere: a Trezor is a self-custody device, not a custodial service. The company never holds customer coins, which is precisely why attackers go after the recovery phrase instead — it is the only thing that can move the funds.

The same day, Swiss hardware wallet maker BitBox posted on X that a phishing mail had gone to its newsletter subscribers and that its preliminary review found it very likely that its newsletter provider was compromised. BitBox added that multiple other Bitcoin companies were targeted and appeared to share the same newsletter provider, that it warned subscribers and reported the phishing domains, and that most links had already been taken down. That is a preliminary assessment from one company, not a confirmed shared root cause across vendors.

How the ShipMonk count went from 14,000 to 81,000

The email incident lands on top of an unresolved data leak. Trezor's own blog post says ShipMonk, one of its shipping providers, suffered a breach exposing customer order data including full names, physical addresses, phone numbers and email addresses. Security firm Halborn's write-up dates the notification to 10 August 2026 and splits the initial scope into 11,742 customers with names, phone numbers, emails and shipping addresses exposed, plus 1,947 with partial exposure. Halborn attributes the intrusion to exploitation of a public-facing Metabase application via SQL injection, escalated to administrator access, followed by extortion emails to ShipMonk from the group ShinyHunters.

Trezor's blog then records an update dated 4 September 2026: on 2 September it was told the breach was larger than stated and also contained order data from a prior cooperation with ShipMonk between November 2019 and August 2021, despite Trezor having repeatedly requested and received written assurance that the data was deleted. BleepingComputer reports that this added roughly 67,000 U.S. customers, bringing the total to 81,000.

The two headline numbers are the same incident measured at different dates, not two separate breaches: 11,742 plus 1,947 is 13,689 ("nearly 14,000"), and adding the 67,000 older U.S. records gives 80,689, which BleepingComputer rounds to 81,000.

What the figures actually establish for a Trezor owner

Nothing in these disclosures indicates that the hardware was broken. Every verified loss vector here runs through data held by suppliers, not through the device. That distinction matters for what you should do: firmware and PINs are not the exposure; your contact details are.

The 81,000 figure is a count of exposed customer records, not a count of phishing emails sent, victims, or coins stolen. Trezor has not disclosed how many recipients got the 9 September email, and no confirmed thefts from that campaign had been reported at the time of writing. It is also an assumption, not a fact, that the ShipMonk list and the email list are the same people — they were held by different vendors.

The valid comparison is with Trezor's earlier contact-data incidents. BeInCrypto notes Trezor warned 66,000 users after a 2024 support-portal breach, and describes the September email incident as the company's third vendor failure in four weeks; it also reports that rival SafePal leaked nearly 40,000 records in the prior month. BeInCrypto further reports that customers have since received scam calls and printed letters, which is the practical consequence of a leak that included phone numbers and home addresses rather than just email.

The Hacker News quotes Trezor saying it deletes or anonymises eShop purchase data after 90 days, chosen as the shortest window covering delivery, returns and refunds. Read against the 2019–2021 records that surfaced in the leaked dataset, that policy shows the limit of a retention rule: it governs what the merchant keeps, not what a third-party processor actually deleted.

What is still unknown

• The provider. Neither Trezor nor BitBox named the compromised email vendor in the statements found.
• The scale of the phishing wave. No recipient count, click-through count or loss figure has been published.
• Whether the incidents are linked. BitBox's shared-provider theory is explicitly preliminary; Trezor says it is still investigating how attackers reached its legitimate domain.
• Any deadline. No dated regulatory filing, notification schedule or investigation report was published alongside these statements, so there is no verified upcoming catalyst to watch.

The single rule that survives all of this: a recovery phrase entered into any website, app or form other than the device itself is a transfer of ownership, and it cannot be reversed.