30
30
30
30
35
30
30
30
30
35
Trezor warns users of email provider breach, phishing attacks
Trezor says attackers breached its third-party email provider and are phishing customers with fake STM32 entropy vulnerability alerts.
Trezor warned customers that threat actors breached its third-party email provider and sent fake 'Critical Security Alert: STM32 Entropy Vulnerability' emails from [email protected], claiming wallet seeds were exposed to brute-force attacks; the phishing domain has been taken down while Trezor investigates. This follows the ShipMonk breach, revised upward from about 14,000 to 81,000 customers (including 67,000 additional US customers) who received orders between May 10 and August 8, 2026. Attackers reportedly exploited a Metabase SQL injection zero-day to access ShipMonk data, and ShinyHunters sent extortion emails.
58
30
45
30
35
30
30
30
45
30
30
30
30
50
Trezor Says 347,000 Users Received Phishing Emails After Brevo Hack
Attackers abused Brevo's SAML SSO to access 138 accounts, sending phishing emails to 347,000 Trezor customers and exfiltrating contacts from 43 accounts.
Trezor said 347,000 of its customers received phishing emails with the subject line 'Critical Security Alert: STM32 Entropy Vulnerability' after the attacker compromised the Brevo marketing platform. Brevo said the intruder created an account, enabled SAML SSO, and used its own identity provider to access 138 accounts, exfiltrating contacts from 43 of them. Trezor reported 2,500 users clicked the malicious link before the site was taken offline 20 minutes after detection; potential fund losses are unknown. Swiss wallet maker BitBox and crypto tax calculator CoinTracking also appear affected, and Trezor separately disclosed a ShipMonk breach now affecting roughly 81,000 people.
65
Multiple crypto companies warn customers of phishing emails after alleged provider breach
Attackers compromised 120 Brevo email accounts and sent convincing phishing emails to Trezor, BitBox, and CoinTracking newsletter subscribers.
Trezor, BitBox, and CoinTracking confirmed that phishing emails were sent to newsletter subscribers after a compromise of their shared email provider, which CoinTracking identified as Brevo. Brevo said an attacker accessed 120 customer accounts and used them to send phishing emails from legitimate company domains, including fake security alerts like 'Critical Security Alert: STM32 Entropy Vulnerability' and 'Data Breach Notice: Please refresh API Keys.' Trezor had already suffered a separate breach exposing details of 81,000 customers, and CertiK reports physical wrench attacks on crypto holders rose 33 percent year-over-year with $124 million in losses in 2026.
55
30
30
30
30
35
30
30
30
30
30
35
30
30
35