Trezor Warns Customers After Brevo Email Breach Fuels Massive Phishing Campaign

Phishing Attack Leverages Brevo Email Compromise

Trezor, the manufacturer of hardware cryptocurrency wallets, has issued its second warning in two months after a cyber‑attack on Brevo, a marketing‑technology firm it uses for newsletters. Hackers exploited the breach to dispatch roughly 347,000 phishing messages to Trezor owners. The emails contained a malicious link that, when clicked, downloaded an application prompting the recipient to enter their wallet backup password. One of the subject lines read “Critical Security Alert: STM32 Entropy Vulnerability,” giving the impression that the communication originated from Trezor itself.

Impact of a Stolen Wallet Password

With a victim’s backup password in hand, an attacker can irreversibly transfer the owner’s funds on the public blockchain. Trezor emphasized that none of its own products, wallet software, or account infrastructure were compromised in the incident, but the breach underscores how third‑party services can become a vector for attacks on end users.

Brevo’s Explanation of the Incident

In a status update, Brevo reported that the intruders gained access to 138 of its accounts, enabling the mass distribution of phishing emails. The company attributed the compromise to a scoping flaw that “wrongly granted” the attackers access to all organizations reachable from the compromised accounts, rather than limiting it to the intended scope.

Earlier ShipMonk Breach Highlights Ongoing Supply Chain Risks

This is not Trezor’s first recent security scare. In August, the firm alerted customers that a shipping partner, ShipMonk, had suffered a data breach. The incident exposed the names, phone numbers, email addresses, and postal addresses of at least 81,000 individuals who purchased or received Trezor hardware. Such exposure can put cryptocurrency holders and other affluent individuals at risk of targeted violence or “wrench” attacks, where physical coercion is used to extract passwords.

Follow‑On Scams and Physical Threats

In the weeks after the ShipMonk breach, some recipients received mailed letters purportedly from Trezor. These letters included a QR code that, when scanned, directed users to a counterfeit webpage designed to harvest wallet passwords, illustrating how a single breach can spawn multiple attack vectors.

Trezor’s Response: Vendor Review and Customer Guidance

Following the Brevo incident, Trezor announced it is re‑evaluating its relationships with third‑party vendors. The company also warned that the compromised email addresses may be reused in future phishing operations, urging customers to remain vigilant and verify any communications claiming to be from Trezor.

Broader Implications for Crypto Security

The Brevo and ShipMonk episodes demonstrate a recurring theme in the cryptocurrency ecosystem: the security of end users often hinges on the defenses of ancillary service providers. As hardware wallet makers strive to protect their devices, the broader supply chain—from email marketers to logistics partners—remains a vulnerable frontier that attackers can exploit to reach valuable targets.