Brevo email breach adds to Trezor's security woes

Trezor has encountered another security challenge following a breach at its third-party email provider Brevo, which left Trezor users exposed to a wave of phishing emails.

The hardware wallet company disclosed that attackers gained access to its email domain, which has since been taken offline, and an investigation is now underway.

Fraudsters alerted Trezor's newsletter subscribers to a supposed "Critical Security Alert: STM32 Entropy Vulnerability" and then attempted to persuade them to hand over their wallet backups.

Our third-party e-mail provider has been breached. Please be aware that the email named ‘Critical Security Alert: STM32 Entropy Vulnerability’ is not coming from us, and it’s a phishing attempt. Do not click on any link.

We have taken down the domain, and we are investigating…

— Trezor (@Trezor) September 9, 2026

Brevo additionally serves as the email provider for cryptocurrency companies such as BitBox, CoinTracking, Peach Bitcoin, and Blocktrainer, each of which has cautioned their users to be on the lookout for phishing attempts.

Phishing attempts targeting CoinTracking employed a fake breach to deceive users, whereas those targeting BitBox warned of a microcontroller entropy bug.

A rough summer for Trezor's partners

In August, Trezor disclosed that its third-party logistics partner ShipMonk had suffered a breach, resulting in the exposure of 13,689 Trezor customers' data.

A month later, the firm announced that the ShipMonk breach had in fact affected more than 80,000 customers.

Additionally, Trezor learned that ShipMonk had not been adhering to a promised 90-day data deletion policy.

Protos has contacted Trezor for a statement and will revise this article if a response is received.