Brevo login flaw enabled phishing email targeting 347K Trezor subscribers
Trezor told Cointelegraph that the phishing email was sent to 347,000 subscribers and said it is treating every address as “known to the attacker and possibly reusable for phishing.”
Asanat Analysis — Why it matters
A Brevo email platform vulnerability exposed 347,000 Trezor subscriber addresses to targeted phishing, representing a significant operational security failure in the hardware wallet supply chain. Brevo's authentication weakness allowed attackers to access Trezor's customer list—a high-value target since hardware wallet users typically hold material cryptocurrency holdings. Trezor's formal notification that addresses are 'possibly reusable for phishing' signals an extended threat horizon beyond the initial campaign.
This incident underscores a critical dependency risk: hardware wallet manufacturers rely on third-party email infrastructure, creating attack surfaces disconnected from their core security model. The scale (347K addresses) and targeting specificity elevate this beyond routine phishing—attackers now have validated contact lists paired with product knowledge. For the sector, this reinforces that cold storage adoption doesn't eliminate operational security requirements for service providers, and that email list access can compromise an entire user cohort regardless of on-chain security posture.