Quick Answer
Trezor users face a credible phishing risk after Brevo’s breach let an attacker send a wallet-draining email through Trezor’s legitimate newsletter channel. Trezor says roughly 347,000 opt-in newsletter addresses were affected, and about 2,500 recipients clicked the malicious link. Do not enter a wallet backup anywhere. Delete the message, verify alerts through Trezor’s official site, and watch for follow-up scams.
Key Takeaways
- Trezor says roughly 347,000 newsletter email addresses were affected.
- The fraudulent email used the subject line “Critical Security Alert: STM32 Entropy Vulnerability.”
- The phishing page attempted to collect a wallet backup, which can give an attacker access to funds.
- Trezor says clicking the link alone did not expose funds unless a wallet backup was entered.
- Brevo says compromised accounts sent messages through legitimate infrastructure that passed normal authentication checks.
What happened in the Trezor phishing breach?
The Trezor phishing breach began after an attacker gained access to Brevo accounts and used Trezor’s newsletter channel to send a fraudulent security alert. Trezor disclosed the incident on September 10, 2026, and said its opt-in newsletter database of roughly 347,000 email addresses could be reused in future phishing campaigns. Trezor’s incident notice explains that the attacker sent the message from an account connected to its legitimate email distribution system.
The immediate danger was not a software flaw in a Trezor device. The danger was a convincing email designed to persuade recipients to disclose a wallet backup. A wallet backup, sometimes called a recovery seed or recovery phrase, can restore access to a wallet. Anyone who obtains that backup can potentially move the assets protected by it.
Trezor says the phishing email used the subject line “Critical Security Alert: STM32 Entropy Vulnerability.” The technical wording was intended to make the alert appear urgent and credible. The practical response is to treat unexpected security emails as untrusted until you independently confirm the notice through Trezor’s website or a verified support channel.
Why did the fraudulent Trezor email look legitimate?
The fraudulent Trezor email looked more credible because it was sent through legitimate Brevo infrastructure rather than from an obvious spoofed address. Brevo says the attacker exploited a SAML single sign-on scoping flaw at 6:30 a.m. UTC on September 9, 2026. The company says 138 accounts were accessed, six accounts were used to send phishing emails, and contact lists were exported from 43 accounts. Brevo’s incident write-up says the malicious messages passed normal email-authentication checks because they used legitimate infrastructure.
Email authentication can help mail providers identify forged messages, but it cannot fully protect recipients when an attacker sends email through a real account on a trusted service. This matters because a message can appear to come from a familiar sender and still contain a harmful link. A correct sender address, familiar branding, or a passed authentication check does not make a request for a wallet backup safe.
Brevo says it closed the attack route and signed out all platform users at 8:30 a.m. UTC, then began deploying a permanent SSO fix that limits access to the organization that owns an SSO configuration. That action addresses the reported access route, but affected email addresses can still be targeted later. Recipients should expect follow-up messages that refer to the original incident or claim that a new verification step is required.
What did the phishing link try to steal?
The phishing link tried to make Trezor recipients download an app that requested their wallet backup. Trezor says entering a wallet backup into the malicious app could lead to loss of funds because the backup can provide the information needed to restore and control a wallet elsewhere. The safe rule is simple: never type a wallet backup into an app, website, email form, or support chat.
Wallet phishing often depends on urgency rather than a technical exploit. A fake vulnerability warning can push a recipient to act before checking whether the notice is real. The wording in this campaign focused on a supposed security issue, but Trezor says the requested action was to provide the backup. That mismatch is the key warning sign: a security notice does not require a customer to disclose the secret that controls the wallet.
Hardware wallets can reduce exposure to some online threats, but hardware protection does not prevent loss after a recovery backup is voluntarily entered into a malicious service. The most sensible approach is to keep the backup offline and private. Users who want to improve account protection should also review how passkeys move between password managers, because stronger account sign-in controls can reduce dependence on passwords for related services.
Were funds exposed if a recipient clicked the malicious link?
Trezor says clicking the malicious link alone did not expose funds unless the recipient entered a wallet backup into the fraudulent app. Trezor says about 2,500 people clicked the link before the phishing domain was disabled. That distinction matters because a click can expose a user to a dangerous page, but the reported theft mechanism required the recovery information that controls the wallet.
A recipient who clicked but did not download the app or enter a backup should still take the incident seriously. Delete any downloaded file, close the page, and avoid returning through the original email. A clicked link also tells an attacker that an address is active, which can increase the chance of later phishing attempts that use different wording.
A recipient who entered a wallet backup has a more urgent problem. Move assets to a newly created wallet using a newly generated backup as soon as possible, using a trusted device and verified Trezor instructions. Stop and contact Trezor support if you are unsure whether the backup was exposed or if you cannot safely complete the move yourself. Do not share the backup with anyone claiming to help recover the wallet.
| Recipient action | Reported risk level | Recommended response |
|---|---|---|
| Received the email but did not open the link | Future phishing risk | Delete the message and remain alert for follow-up emails. |
| Clicked the link but entered no backup | Higher phishing exposure, no reported direct fund exposure | Close the page, delete downloads, and do not reuse the link. |
| Downloaded the app but entered no backup | Potential device and phishing risk | Remove the app and use a trusted security review process. |
| Entered a wallet backup | Critical risk of wallet takeover and fund loss | Move assets to a new wallet and contact Trezor support if needed. |
How did Trezor respond to the Brevo breach?
Trezor says it disabled email sending, suspended its Brevo account, and took the phishing domain down at the DNS level within 20 minutes. Those actions were designed to stop additional messages and make the malicious destination unavailable. Fast domain disruption can limit further clicks, although it cannot reverse a backup disclosure that already occurred.
Trezor’s response also makes clear why recipients should not rely on an email thread for confirmation. A legitimate newsletter channel was used in this case, so replying to the email or following a later “cleanup” link could expose a recipient to another attempt. Verify any claimed Trezor alert by manually entering the official site address in a browser rather than selecting a link in the message.
The incident is separate from a device vulnerability claim in the phishing subject line. Users should update hardware wallet software only through official Trezor tools and verified instructions, not through an attachment or a downloaded program promoted in an email. Similar caution applies when security researchers warn that router flaws face active attacks, because attackers often use legitimate security concerns as material for convincing scams.
What should Trezor users do now?
Trezor users should delete the fraudulent email, avoid its link, and keep their wallet backup offline. Trezor says the campaign targeted newsletter recipients and could lead to future phishing because the affected email addresses may be reused. The most important practical step is to separate email alerts from wallet recovery actions: emails can notify you of an issue, but they should never be the place where you reveal a backup.
- Delete emails with the subject line “Critical Security Alert: STM32 Entropy Vulnerability.”
- Open Trezor’s official website directly if you need to check a security notice.
- Keep your wallet backup offline and do not photograph, upload, or paste it into a digital form.
- Remove any app downloaded from the phishing page before using the device for wallet activity.
- Move funds to a new wallet immediately if you entered the backup into the fraudulent app.
Trezor users should also examine unexpected messages that mention leaked data, account verification, or emergency updates. Data breaches frequently create an opportunity for impersonation because attackers can tailor a message to a known customer relationship. The exposure reported in the AdaptHealth data breach illustrates why personal information and contact details can remain useful to criminals after the original incident is disclosed.
Stop and use a separate trusted device if you believe a downloaded app may have compromised your phone or computer. A normal user should not attempt advanced malware removal, firmware changes, or wallet recovery procedures without trusted vendor guidance, particularly when active funds remain in the wallet.
How can recipients spot follow-up Trezor phishing emails?
Follow-up Trezor phishing emails are likely to repeat the same pressure tactics: an urgent security warning, a request to download a tool, or a demand for a wallet backup. Trezor says the affected newsletter addresses could be reused for future phishing, so deleting the original message does not remove the broader risk. The practical response is to evaluate the requested action, not only the sender name or the visual design.
A message is unsafe if it asks you to enter a wallet backup, install an app from an email link, or bypass normal device-management steps. A genuine security notice can explain a problem and direct users to official resources, but it does not need the secret information that restores access to a wallet. Recipients should be especially careful with messages that claim a deadline or threaten immediate asset loss.
Independent reporting also confirmed that the campaign used Trezor’s legitimate newsletter channel after the Brevo breach. BleepingComputer’s reporting describes the campaign as targeting Trezor users through that legitimate channel. That context explains why basic sender checks were insufficient and why manual verification is the safer habit.
What does the Brevo incident mean for wallet security?
The Brevo incident shows that wallet security depends on more than the hardware wallet itself. A secure device can still be undermined when a customer is persuaded to reveal the backup that restores the wallet. The backup remains the highest-value secret in the recovery process, and protecting it offline is more important than reacting quickly to an alarming email.
Third-party services can also become part of a company’s security exposure. Brevo says the incident involved a SAML SSO scoping flaw, which affected access boundaries between organizations using the platform. Customers cannot directly fix a vendor’s identity-control issue, but customers can reduce harm by refusing requests for irreversible secrets and by verifying sensitive instructions outside the channel that delivered them.
For most users, the practical lesson is not to distrust every legitimate company email. The practical lesson is to use email only as a prompt to independently check information. Open the company’s official site manually, use a known app, and never provide a wallet backup as part of a support or security process.
FAQ
Was Trezor itself hacked?
Trezor says the phishing emails were sent after an incident involving Brevo, its third-party newsletter marketing platform. The reported attack involved Trezor’s email channel and newsletter contacts, not a disclosed compromise of Trezor wallet backups.
What was the subject line of the fake Trezor email?
The fraudulent Trezor email used the subject line “Critical Security Alert: STM32 Entropy Vulnerability.” Trezor says the message linked to an app that requested a wallet backup.
Can clicking the Trezor phishing link drain a wallet?
Trezor says clicking the malicious link alone did not expose funds unless the recipient entered a wallet backup. A recipient who downloaded software or entered recovery information should treat the incident as urgent and use verified support guidance.
What should I do if I entered my Trezor wallet backup?
A Trezor user who entered a wallet backup should move assets to a newly created wallet with a new backup as soon as possible. Contact Trezor support if you cannot complete that process safely, and do not disclose the backup to anyone offering help.
Will Trezor users receive more phishing emails?
Trezor says roughly 347,000 email addresses in its opt-in newsletter database were affected and could be reused for future phishing. Trezor users should remain cautious about security alerts, especially messages requesting downloads or recovery information.