Trezor's spoofed alert reused the language of the $112.7m Coldcard exploit

The arithmetic sits in the two columns this report keeps apart. Trezor's ShipMonk exposure now stands at 80,689 customers, after old US order records from 2019 to 2021 turned out to have been stored and exposed ^[9]. SafePal's order-tracking plugin exposed roughly 39,798, with seed phrases, private keys and wallet credentials not compromised in that case ^[8]. Call it 120,487 people whose contact details are out ^[1]. Memeburn's August table filed both companies under data breaches and Coldcard under device exploit ^[11]. The Coldcard column reads differently: Galaxy Research confirmed 190 victims directly on August 14 and at least $112.7m in bitcoin taken through firmware flaws, 1,778.84 BTC ^[12]. That is about $593,000 per confirmed victim, and it values the stolen coin at about $63,356 each, so the dollar figure moves with the price while the coin count stays fixed ^[3][6].

The fake notice told recipients that one device in four could be compromised and that their recovery phrases might not carry enough entropy, language the report says closely resembled the issues in the Coldcard attack ^[4]. A real firmware failure at one vendor hands a phishing operator a technically credible story to tell the customers of every other vendor.

The checks the message passed certify that a server is authorised to send mail for a domain and leave the question of who is operating that authorised account untouched ^[3]. So the catch came from Trezor reading its own outbound mail, and Decrypt reported that Trezor recognised the message as fake and warned readers not to click the links ^[7].

Sort the incidents by supplier: an email platform sent the September notice, and ShipMonk held the old order records ^[1][9]. Global-e held the order details and contact information exposed in Ledger's January incident, with the customer count undisclosed, and a third-party order-tracking plugin held SafePal's ^[10][8]. Phishing off that kind of list has already reached Ledger customers through physical mail ^[15].

My read is that the volume is in the trust layer and the money, so far, is in firmware. Chainalysis put crypto scams and fraud at $17bn in 2025, which makes the entire Coldcard total 0.66 per cent of a single year of fraud ^[13][4]. The counter-case is that reach converts, and nobody in this material has published a conversion rate for a single email campaign. If a hundred of those 120,487 contacts were drained at Coldcard's average per victim, that is about $59m, and a marketing email provider stops being a line item ^[8]. If attributed losses from the September wave stay near zero, the review budget stays where the $112.7m actually went ^[12].