Trezor Reveals Another Data Breach After Scammers Target Marketing Platform
Bitcoin Magazine Trezor Reveals Another Data Breach After Scammers Target Marketing Platform Users of the bitcoin hardware wallet were targeted with phishing attacks. This post Trezor Reveals Anoth...
Trezor has warned that a data breach at the third-party marketing platform it uses for sending newsletters is leading criminals to target customers with phishing attacks.
The top hardware wallet manufacturer said Wednesday that an unauthorized actor got access to Brevo’s system and sent emails to 347,000 Trezor customers. Brevo is a platform businesses use to send customer communications.
Scammers managed to use Trezor’s domain name to send the email, making the phishing attempt all the more believable. The email contained a malicious link asking users to download an app and enter their wallet backup.
Our third-party e-mail provider has been breached. Please be aware that the email named ‘Critical Security Alert: STM32 Entropy Vulnerability’ is not coming from us, and it’s a phishing attempt. Do not click on any link.We have taken down the domain, and we are investigating…
The news comes after Trezor last month announced that data from 11,742 customers had been exposed after its third-party fulfillment partner, ShipMonk, was targeted.
It then said last week that an additional 67,000 U.S. customers had their names, emails, phone numbers, shipping addresses and order numbers leaked in the breach.
“We took down the domain at the DNS level within 20 minutes, preventing the link from working for anyone else and limiting access to 2,500 people who had clicked it before we took it down,” Trezor said on Wednesday.
“These addresses might be potentially used for other phishing attacks in the future. No other Trezor system was touched,” Trezor added.
Trezor reminded users that it never asks customers to ask for their wallet backups.
Criminals have been targeting data this year, with scammers getting hold of customer information via crypto wallet Ledger’s payment processor Global-e to send phishing emails.
Crypto wallet provider SafePal last month also announced a data breach that involved unauthorized access to about 39,798 customers’ order information, including personal details such as names, addresses and purchase data.
Asanat Analysis — Why it matters
Trezor's second breach in as many months reveals a systemic vulnerability in hardware wallet supply chains rather than core wallet security. The attack surface has shifted from direct infrastructure to third-party service providers (marketing platform Brevo, fulfillment partner ShipMonk), making customer targeting easier even though private keys remain protected. This mirrors Ledger's Global-e breach pattern from earlier 2024, suggesting attackers are now mapping the entire vendor ecosystem of custody providers.
The phishing sophistication here—spoofing Trezor's domain and invoking a fake 'STM32 entropy vulnerability'—exploits legitimate security concerns to lower user skepticism. Only 2,500 of 347,000 targeted users clicked before takedown, but the real risk compounds: these email lists now exist in criminal databases for future attack campaigns, creating persistent reputational drag and customer churn risk for Trezor regardless of actual wallet compromise.
This cascade of breaches across Trezor, Ledger, and SafePal signals that hardware wallet providers may lack contractual leverage or auditing rigor over third-party vendors. For crypto users, the lesson is that owning non-custodial keys doesn't eliminate operational security risk—backup phrases remain the single point of failure once email/shipping data are public. Market consolidation pressure on hardware wallet UX may intensify if providers must now absorb vendor due diligence costs.