Scammers target hundreds of thousands of crypto owners after Trezor confirms data breach of email provider
Third-party breaches at Trezor's email and shipping vendors exposed customer data, fueling phishing campaigns targeting hundreds of thousands of crypto wallet owners.
Trezor confirmed that a breach at Brevo, its marketing email provider, exposed customer contact data and let hackers send roughly 347,000 phishing emails claiming a fake 'STM32 Entropy Vulnerability' and asking victims for their wallet backup password. Brevo said attackers accessed 138 accounts by abusing overly broad, improperly scoped access privileges. Trezor was also hit weeks earlier by a breach at shipping partner ShipMonk that exposed names, phone numbers, email addresses, and postal addresses of at least 81,000 wallet buyers. Trezor stated its own products, wallets, and account systems were unaffected and warned customers to expect further phishing attempts.
- Brevo compromise let attackers send ~347,000 phishing emails to Trezor customers
- 138 Brevo accounts accessed via improperly scoped access rights
- Fake 'STM32 Entropy Vulnerability' alert lured victims to enter wallet backup password
- ShipMonk breach exposed data of at least 81,000 Trezor hardware buyers
- Victims face crypto theft risk, including physical 'wrench' attacks
Full article457 words · extracted from techcrunch.com · click to collapse
Hardware crypto wallet maker Trezor is warning customers for the second time in as many months that one of the companies it relies on was hacked, exposing the data of Trezor’s customers to hackers.
In a blog post this week, the hardware wallet maker said a cyberattack on Brevo, a marketing tech company that Trezor uses to send newsletters, allowed hackers to send around 347,000 phishing emails to Trezor customers with a malicious link purporting to come from the wallet maker.
The link, when tapped, downloads an app that asks the victim for their wallet backup password. According to Trezor, one of the email subject lines said: “Critical Security Alert: STM32 Entropy Vulnerability.”
With a stolen wallet password, a hacker can irreversibly steal the person’s funds on the public blockchain.
Brevo said in an incident status post that the hackers were able to access 138 Brevo accounts to send out the mass volume of phishing messages. Brevo said that the hackers abused a flaw that meant the hackers’ access was “not properly scoped.” The company said that the hackers’ access was “wrongly granted” to all organizations that the hackers’ accounts could reach.
The breach highlights a common security incident, where hackers compromise data held by third-party companies that are necessary for fulfilling orders or purchases from customers. Trezor says none of its products, wallets, or account system was affected by the incident.
This is the second breach in recent weeks affecting Trezor, after the company alerted customers in August that one of its shipping partners was compromised in a data breach. The incident at the mailing company ShipMonk exposed the names, phone numbers, email addresses, and postal addresses of at least 81,000 people who bought and received Trezor wallet hardware.
The data breach could put crypto owners and other wealthy individuals at risk of targeted violence and so-called “wrench” attacks, which rely on physical attacks to extract passwords from people.
In the weeks following the breach at ShipMonk, some people have received letters by mail claiming to be from Trezor, featuring a QR code that, when scanned, opens up a fake page that attempts to steal the victim’s crypto wallet password.
Trezor said it was reevaluating its relationships with its vendors and warned customers that their email addresses may be used again for future phishing attacks.
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.
Zack Whittaker is the security editor at TechCrunch. He also authors the weekly cybersecurity newsletter, this week in security.
He can be reached via encrypted message at zackwhittaker.1337 on Signal. You can also contact him by email, or to verify outreach, at [email protected].
Text extracted automatically; images, tables and formatting may be missing. Original: https://techcrunch.com/2026/09/11/scammers-target-hundreds-of-thousands-of-crypto-owners-after-trezor-confirms-data-breach-of-email-provider/