Crypto users are facing another warning about phishing attacks after hardware wallet company Trezor confirmed that hackers compromised one of its third-party service providers.
The incident did not involve Trezor’s hardware wallets or its core account systems. Instead, attackers gained access through Brevo, the marketing and email platform Trezor uses to communicate with customers.
The breach gave scammers an opportunity to target a huge number of crypto users with convincing messages designed to steal their wallet credentials.
Nearly 347,000 phishing emails sent
According to Trezor, attackers used compromised Brevo accounts to send approximately 347,000 phishing emails to people associated with Trezor.
- Advertisement -
The emails were designed to look like legitimate security notifications from Trezor. One of the messages reportedly used the subject line:
“Critical Security Alert: STM32 Entropy Vulnerability.”
The goal was to create a sense of urgency and convince recipients that their crypto wallets were at immediate risk.
The emails included a malicious link. Victims who followed it were directed toward an application that requested their wallet backup password.
That password is extremely sensitive. If attackers obtain the credentials needed to recover a crypto wallet, they may be able to move the assets stored in it. Because blockchain transactions generally cannot be reversed, stolen funds can be extremely difficult—or impossible—to recover.
- Advertisement -
How the Brevo breach happened
Brevo, the email marketing company involved in the incident, said attackers were able to gain access to 138 customer accounts and use them to distribute the phishing campaign.
The company said the incident was linked to a flaw in how access permissions were handled. According to Brevo, the attackers’ access was not properly limited and was instead incorrectly extended to organizations that their compromised accounts could reach.
This illustrates an increasingly common cybersecurity problem: a company does not necessarily have to be hacked directly for its customers to become targets.
- Advertisement -
Instead, attackers can compromise a third-party provider that has access to customer information or communication systems.
Trezor says its wallets were not compromised
For Trezor customers, one important distinction is that the company says its own products and core systems were not breached.
The incident involved the third-party email provider used to communicate with customers, rather than Trezor’s hardware wallets or account infrastructure.
However, that does not make the incident harmless.
An exposed email address can become a valuable weapon for scammers, particularly when criminals know that the address belongs to a cryptocurrency user.
Attackers can use that information to create highly convincing phishing emails, fake support messages, fraudulent security warnings and other targeted scams.
This isn’t Trezor’s first recent data breach
The Brevo incident comes shortly after another security incident involving one of Trezor’s vendors.
In August, Trezor warned customers that ShipMonk, a company involved in shipping its hardware wallets, had experienced a data breach.
That incident reportedly exposed personal information belonging to at least 81,000 Trezor customers, including names, phone numbers, email addresses and postal addresses.
When combined with the latest email-related incident, the situation creates a broader security concern for crypto owners.
The problem isn’t necessarily that attackers can directly access a wallet. Instead, leaked personal information can help criminals identify and target people who may own valuable cryptocurrency.
Why leaked crypto-user data can be dangerous
For many online accounts, a leaked email address is primarily a privacy concern.
For cryptocurrency owners, the consequences can potentially be more serious.
A criminal who knows that someone owns crypto—and has additional information such as their name, phone number or home address—may attempt increasingly aggressive forms of social engineering.
There have already been cases of scammers sending physical letters that appear to come from Trezor. Some reportedly included QR codes designed to send victims to fake websites where they could be tricked into providing their wallet credentials.
This type of attack shows how criminals can combine information from data breaches with traditional phishing techniques.
In extreme cases, publicly exposed information about crypto holders can also create the risk of physical threats, including so-called “wrench attacks,” where criminals attempt to force victims to reveal passwords or unlock their cryptocurrency through physical intimidation.
Trezor customers should be especially cautious
Trezor has warned customers that their email addresses could potentially be used in additional phishing campaigns in the future.
That means users should treat unexpected messages claiming to come from Trezor with extra caution—even if the email looks professional or contains details that appear legitimate.
Some basic precautions can make a significant difference:
- Never enter your wallet recovery phrase or backup credentials into a website or application prompted by an email.
- Be suspicious of urgent security warnings that demand immediate action.
- Avoid clicking links in unexpected crypto-related emails.
- Verify security announcements through Trezor’s official website rather than through links contained in messages.
- Never share your wallet recovery phrase with anyone claiming to be customer support.
- Be cautious with QR codes included in unexpected letters, emails or messages.
Most importantly, a legitimate hardware-wallet company should never need your recovery phrase or private wallet credentials to “protect” your funds.
The bigger lesson: third-party security matters
The Trezor incident highlights an important reality of modern cybersecurity.
A company can invest heavily in protecting its own systems while still being exposed through the vendors it depends on.
Email platforms, payment processors, shipping companies, analytics providers and other third-party services often handle customer information or interact with business systems. If one of those providers is compromised, attackers may find a path to valuable data or customers—even without breaking into the main company’s infrastructure.
For crypto companies, the stakes are particularly high.
A stolen email address might lead to a phishing attack. A successful phishing attack could lead to stolen wallet credentials. And stolen credentials could ultimately result in irreversible financial losses.
Trezor says it is now reviewing its relationships with third-party vendors following the incidents.
For cryptocurrency users, however, the latest breach is another reminder that protecting digital assets involves more than securing the wallet itself. The personal information surrounding the wallet can be just as valuable to an attacker.
