Phishing Campaign Targets Trezor Customers After Brevo Email Provider Breach

This breach underscores the vulnerabilities inherent in third-party vendor relationships, particularly in the cryptocurrency sector.

• On September 9, 2026, scammers exploited a breach at Brevo, Trezor's email provider, sending phishing emails to 347,000 subscribers.
• The emails falsely warned of a fabricated vulnerability in Trezor devices and directed users to download a malicious app.
• Trezor confirmed that its systems were unaffected and has since suspended its Brevo account while reevaluating vendor relationships.

• Third-party risks: Hardware wallet providers like Trezor rely on external vendors for services, creating vulnerabilities that can expose customer data without compromising their core systems.
• Recent breaches: This incident follows an August 2026 breach at Trezor's shipping partner, ShipMonk, which exposed data of at least 81,000 customers, leading to further phishing attempts.
• Rising attacks: The cryptocurrency sector is experiencing an increase in targeted attacks, including phishing and physical "wrench" attacks that leverage leaked personal data.

On September 9, 2026, unauthorized actors accessed Brevo accounts through a flaw in the SAML Single Sign-On (SSO) system. This breach allowed them to send phishing emails that appeared to originate from Trezor's legitimate newsletter infrastructure, specifically from the domain mailing.trezor.io. The emails passed SPF, DKIM, and DMARC checks, making them look credible to recipients.

The phishing emails were titled "Critical Security Alert: STM32 Entropy Vulnerability" and claimed a factory defect affecting one in four Trezor devices. They included a link to a malicious app that requested users' wallet recovery phrases, posing a significant risk of irreversible fund loss on public blockchains. Trezor quickly responded by posting warnings on social media and its blog, confirming that the breach affected its opt-in newsletter database of approximately 347,000 addresses.

Brevo reported that access was gained to 138 accounts, with six accounts used for phishing and 43 for contact exports. Trezor acted swiftly, suspending the Brevo account and blocking the domain within minutes of discovering the breach. However, approximately 2,500 clicks occurred on the phishing links before mitigation efforts were implemented.

This incident is particularly concerning as it highlights the ongoing risks associated with third-party vendor relationships in the cryptocurrency space. The reliance on external providers for essential services like email marketing and shipping creates a supply-chain risk where breaches can expose customer data without compromising the core wallet systems.

Moreover, the incident follows a troubling trend of increasing targeted attacks on cryptocurrency users. The combination of phishing attempts and physical attacks, such as "wrench" attacks, indicates a growing sophistication among cybercriminals. As the cryptocurrency market continues to expand, so too does the potential for exploitation by malicious actors.

• Trezor customers: Approximately 347,000 newsletter subscribers are at risk of phishing attacks.
• Cryptocurrency users: Broader implications for all users of hardware wallets as phishing attempts become more sophisticated.
• Vendors and partners: Companies relying on third-party services may face increased scrutiny and risk management challenges.

• Increased phishing attempts: Monitor for a rise in phishing campaigns targeting Trezor users and other cryptocurrency wallet customers.
• Vendor relationship evaluations: Watch for Trezor's actions regarding its vendor partnerships and any changes in their security protocols.
• Regulatory responses: Keep an eye on potential regulatory changes in the cryptocurrency sector aimed at enhancing security measures for third-party vendors.