Trezor and BitBox have jointly issued a security warning after scammers exploited a breach of Trezor’s email infrastructure to launch a coordinated phishing campaign against users of both hardware wallet platforms. The incident underscores growing security risks facing the cryptocurrency custody sector as attackers increasingly target users of hardware wallets, which are considered among the safest methods for storing digital assets.
The Prague-based company, operated by SatoshiLabs, confirmed that its email service had been compromised, allowing threat actors to gain access to customer contact information. The attackers subsequently leveraged a shared newsletter provider to distribute fraudulent security alerts purporting to originate from both Trezor and BitBox, the Zug-based hardware wallet manufacturer. The fake notifications were designed to deceive Bitcoin users into clicking malicious links and divulging sensitive credentials, including private keys and recovery phrases.
Scope and Response
The phishing messages mimicked legitimate security communications from both providers, creating confusion among users who might otherwise recognize suspicious activity. By distributing the fraudulent alerts through a mutual newsletter service provider, the attackers achieved significant reach across overlapping customer bases of both wallet platforms. The coordinated nature of the attack suggests a sophisticated operation targeting high-value cryptocurrency holders.
Marek Palatinus, co-founder of SatoshiLabs, and Thomas Voegtlin, co-founder of Shift Crypto, coordinated the public disclosure to ensure affected users received timely warnings. Both companies emphasized that legitimate security updates from their platforms would never request users to provide private keys or recovery phrases through unsolicited communications. Industry best practices dictate that hardware wallet providers communicate critical security information through verified channels only.
Implications for European Fintech Sector
The incident reflects broader vulnerabilities in cryptocurrency infrastructure and third-party service dependencies that regulators across Europe are increasingly scrutinizing. As the European Union advances its regulatory framework for digital asset markets, including the Markets in Crypto-Assets Regulation (MiCA), questions surrounding cybersecurity standards and breach notification protocols have gained prominence among policymakers.
Hardware wallet providers operate in a regulatory grey zone across much of Europe, with varying requirements depending on jurisdiction. While custody service providers fall under stricter oversight in certain member states, many hardware wallet manufacturers have historically escaped formal regulation. The Trezor-BitBox incident may accelerate discussions about establishing minimum cybersecurity standards and mandatory breach disclosure timelines for companies handling cryptocurrency customer data.
The attack also highlights the cascading risks inherent in digital finance supply chains. Third-party service providers—in this case, a newsletter platform—can become critical infrastructure vulnerabilities. European financial regulators have signaled heightened attention to operational resilience and third-party risk management, making this incident relevant to broader regulatory conversations about fintech security governance across the continent.
Users of both platforms were advised to disregard unsolicited communications requesting sensitive information and to verify all security communications directly through official company websites and authenticated channels.