Technology and Science11 September, 20262 min read
Trezor Confirms Breach Of Email Provider, Attackers Send 347,000 Phishing Messages
This article is an automated aggregation of coverage from news outlets. Our editorials offer in-depth analysis curated by the NewsCord team.
Breach of Brevo, a third-party email provider, enabled 347,000 phishing emails to Trezor users. 2,500 users clicked embedded malicious link in phishing emails.
Brevo breach fuels Trezor phishing
Trezor confirmed that a breach of its third-party email provider allowed attackers to send roughly 347,000 phishing messages from Trezor’s own domain to customers, with the campaign tied to emails sent since September 9, 2026.
In its public statement, Trezor said: “Our third-party e-mail provider has been breached. Please be aware that the email named ‘Critical Security Alert: STM32 Entropy Vulnerability’ is not coming from us, and it’s a phishing attempt. Do not click on any link.”
The phishing emails used an official sender address and familiar branding, and they pushed recipients toward a fraudulent app that asked them to enter their wallet backup phrase.
BleepingComputer reported that Trezor warned the attacks targeted 347,000 email addresses and affected 2,500 users who clicked an embedded malicious link before the domain was disabled.
Trezor said it took down the domain used in the phishing attacks within 20 minutes, limiting the campaign’s impact to those 2,500 clickers.
How the scam worked
The emails claimed a “hardware microcontroller vulnerability” in Trezor cold storage wallets’ STM32 microcontrollers could expose seeds to brute-force cracking, and recipients were urged to click a malicious link. BleepingComputer said the phishing emails tried to trick recipients into clicking a malicious link that prompted them to download an app that asked them to enter their wallet backup. Trezor warned that the incident affected its opt-in newsletter database, “roughly 347,000 email addresses,” and said the addresses “might be potentially used for other phishing attacks in the future.”
In the same disclosure, Trezor said, “No other Trezor system was touched,” and it added that it suspended the Brevo account to stop further email distribution. TechCrunch described the link’s endgame as downloading an app that asks for the victim’s wallet backup password, and it said a stolen wallet password could let a hacker “irreversibly steal the person’s funds on the public blockchain.”
Vendor fallout and next risks
Brevo said hackers accessed 138 Brevo accounts to send the mass volume of phishing messages, and it said the access was “not properly scoped” and “wrongly granted” to all organizations the hackers’ accounts could reach. Trezor also said it moved quickly once the campaign was spotted, and BleepingComputer reported that it disabled the phishing domain within 20 minutes, cutting off the link after 2,500 clicks. Trezor’s disclosure placed the incident in a broader pattern of vendor-side problems, with TechCrunch noting it was the second breach in recent weeks after a ShipMonk compromise that exposed names, phone numbers, email addresses, and postal addresses of at least 81,000 people who bought and received Trezor wallet hardware.
TechCrunch also said the ShipMonk breach could put crypto owners and other wealthy individuals at risk of targeted violence and “wrench” attacks, and it described letters with a QR code that opened a fake page to steal wallet passwords. Trezor told customers it was reevaluating its relationships with its vendors and warned that their email addresses may be used again for future phishing attacks.