Trezor and BitBox warn of fake security alerts
Two hardware wallet makers found their email systems compromised, leading to fraudulent security warnings sent to users.
Trezor and BitBox, two companies that make hardware wallets, both discovered breaches in their email systems on September 10, 2026. The compromises allowed attackers to send fake security alerts to users. BitBox reported that multiple Bitcoin companies appeared to have been targeted through a shared newsletter provider. Trezor separately confirmed a breach at its own email service.
A hardware wallet is a small device, similar to a USB stick, that stores the private keys needed to access and move cryptocurrency. Private keys are like passwords that prove ownership. Users keep their wallets offline and away from internet-connected computers, which makes them much harder to hack than software wallets stored on phones or computers. The devices sign transactions locally, meaning they authorize cryptocurrency transfers without exposing the keys themselves.
Scammers used the compromised email access to send messages that looked like legitimate security warnings from these companies. The fake alerts typically ask users to verify their account, update their device firmware, or confirm their holdings. These messages are designed to trick recipients into clicking malicious links or entering sensitive information. Users who follow instructions in such emails risk losing their cryptocurrency, even if their hardware wallet itself remains secure.
Hardware wallet users rely heavily on email notifications from their wallet providers. They expect these messages to be genuine, which makes phishing attacks especially dangerous. A fake security alert carries weight because actual security breaches do happen, and users want to respond quickly to protect their assets. The combination of a real email system breach and stolen user trust makes these attacks particularly effective.
The exact scope of the breaches remains unclear. Neither company has disclosed how many users received fake alerts or whether any cryptocurrency was actually stolen. Users who received suspicious messages should verify them directly on the official websites before clicking any links. The incident highlights why security-conscious holders should enable two-factor authentication on their accounts and treat unexpected security alerts with skepticism, even from known companies.
Originally reported by Cointelegraph - Read Cointelegraph's report.