Trezor Says Third-Party Email Breach Let Phishers Use Its Own Domain

The detail that matters is not the phishing itself but the vector: attackers abusing a vendor's own domain, which defeats the domain-based trust signals users are taught to check. That it surfaced alongside a matching campaign at a rival hardware wallet maker points to a shared supplier or playbook rather than an isolated incident. For a sector whose pitch is self-custody and verified hardware, repeated third-party exposure is an awkward pattern. Whether these vendors converge on stricter supplier controls, or the same weak link keeps surfacing, is the open question.