Trezor warns of second breach in weeks after hack at email vendor Brevo

Hardware crypto wallet maker Trezor is warning customers for the second time in as many months that one of the companies it relies on was hacked, exposing customer data to hackers. In a blog post this week, Trezor said a cyberattack on Brevo, a marketing tech company it uses to send newsletters, allowed hackers to send around 347,000 phishing emails to Trezor customers containing a malicious link purporting to come from the wallet maker.

The link, when tapped, downloads an app that asks the victim for their wallet backup password. According to Trezor, one of the email subject lines read: “Critical Security Alert: STM32 Entropy Vulnerability.” With a stolen wallet password, a hacker can irreversibly steal a person’s funds on the public blockchain.

Brevo said in an incident status post that hackers accessed 138 Brevo accounts to send the mass phishing campaign, exploiting a flaw that left the hackers’ access “not properly scoped” and “wrongly granted” to all organizations those accounts could reach. The breach highlights a common security pattern, in which hackers compromise data held by third-party companies necessary for fulfilling customer orders. Trezor said none of its own products, wallets, or account systems were affected.

This marks the second breach in recent weeks tied to Trezor, after the company alerted customers in August that a shipping partner had been compromised. That incident, at mailing company ShipMonk, exposed the names, phone numbers, email addresses, and postal addresses of at least 81,000 people who bought and received Trezor wallet hardware. In the weeks following the ShipMonk breach, some people received letters by mail claiming to be from Trezor, featuring a QR code that opens a fake page attempting to steal a victim’s crypto wallet password.

Trezor said the data exposure could put crypto owners and other wealthy individuals at risk of targeted violence and so-called “wrench” attacks, which rely on physical coercion to extract passwords. The company said it is reevaluating its vendor relationships and warned customers their email addresses may be used again in future phishing attempts.

Why it matters

Back-to-back breaches at Trezor’s third-party vendors show how supply-chain compromises can put crypto holders at physical as well as financial risk, even when a company’s own core systems stay secure.