A second breach in two months

Trezor told customers that another company it depends on was hacked, exposing customer data. The hardware wallet maker is now warning users for the second time since August.

347,000 phishing emails

Attackers broke into Brevo, the marketing platform Trezor uses for newsletters, and blasted roughly 347,000 emails carrying a malicious link that looked like it came from Trezor.

The bait was a fake alert

One subject line read like a genuine security warning. Tapping the link downloads an app that asks for your wallet backup password, and once a thief has that, the funds are gone for good.

“Critical Security Alert: STM32 Entropy Vulnerability”

Access that was never scoped

Brevo said hackers got into 138 accounts by abusing a flaw where their access was "not properly scoped" and was wrongly granted across every organization those accounts could reach.

“wrongly granted”

The shipping partner leak

In August, a breach at mailing company ShipMonk exposed names, phone numbers, emails, and home addresses of at least 81,000 Trezor buyers. Some have since received scam letters with QR codes.

Knowing who owns crypto is the risk

A list of confirmed wallet owners with home addresses invites physical "wrench" attacks, where thieves beat passwords out of people. Trezor says its products were untouched and is reviewing its vendors.