Trezor's third scare in a month or two and why it's still not a wallet problem

Trezor's third-party email provider got breached, and whoever did it used it to send phishing mail out from Trezor's actual domain with the subject line "Critical Security Alert: STM32 Entropy Vulnerability."

Worked so well mainly because of the fresh ptsd people still have from Coldcard's real entropy bug that resulted in the huge exploit.

I'm seeing people lump this in with a broader "hardware wallets aren't safe anymore" narrative and that's not really what's going on.

This is Trezor's second or third scare in about a month or two now, and every one of them has been a backend problem, a shipping vendor, an email vendor. None of it is has been a failure in the wallet hardware or the firmware. Those have held up through all of it.

Not going to oversell that though, we don't know what we don't know yet, something could surface later. But based on what's actually been disclosed so far, the product itself is still doing its job. What keeps failing is the backend stuff they are outsourcing from third party vendors.

The real problem is that Trezor keeps outsourcing pieces of its operation to third parties that clearly aren't held to the same security bar as the wallet itself. That's on them to fix, either vet those vendors way harder or pull more of this in-house so there's one less external target sitting there to get compromised.

For us, the awkward part is that the "check if it's the verified domain" advice is pointless now because this one genuinely was the real domain, hijacked instead of spoofed. So the bar has to move past that now, treat unexpected every security alerts as suspicious no matter who they're from, and keep your seed phrase somewhere no email or link can ever touch.

How are you all feeling about this one, still solid or getting a little rattled?