PRAGUE, September 12 — For the second time in as many months, hardware crypto wallet maker Trezor has told its customers that a company it relies on was hacked, and that their personal data may now be in the hands of attackers. The company said in a blog post published in the week of September 11 that a cyberattack on Brevo, a marketing technology company Trezor uses to send its newsletters, allowed hackers to send around 347,000 phishing emails to Trezor customers.
The emails carried a malicious link purporting to come from the wallet maker. Tapping it downloads an app that asks the victim for their wallet backup password.
Trezor said one of the email subject lines read: “Critical Security Alert: STM32 Entropy Vulnerability.”
Why a stolen password is the whole ballgame
With a stolen wallet password, a hacker can irreversibly steal the person’s funds on the public blockchain. There is no bank to call, no chargeback to file. That is the part that lands hardest for crypto holders across Asia, where self-custody wallets have become a common way for people to hold savings outside the traditional banking system.
Brevo said in an incident status post that the hackers were able to access 138 Brevo accounts in order to send out the mass volume of phishing messages. The company said the hackers abused a flaw that meant their access was “not properly scoped,” and that their access was “wrongly granted” to all organizations the hackers’ accounts could reach.
Trezor stated that none of its products, wallets, or account system were affected by the incident.
A second breach in weeks
The Brevo breach is the second affecting Trezor in recent weeks. In August 2026, Trezor alerted customers that one of its shipping partners had been compromised in a data breach. That incident, at mailing company ShipMonk, exposed the names, phone numbers, email addresses, and postal addresses of at least 81,000 people who bought and received Trezor wallet hardware.
Such data breaches can put crypto owners and other wealthy individuals at risk of targeted violence and so-called “wrench” attacks, which rely on physical attacks to extract passwords from people. In the weeks following the ShipMonk breach, some people received letters by mail claiming to be from Trezor, featuring a QR code that, when scanned, opens a fake page attempting to steal the victim’s crypto wallet password.
Trezor said it was reevaluating its relationships with its vendors and warned customers that their email addresses may be used again for future phishing attacks. The incident illustrates a common security problem in which attackers compromise data held by third-party companies that businesses depend on to fulfill orders or purchases from customers.
For communities and families across the region who have moved savings into crypto, the lesson is closer to home than the technical language suggests: the weak point is often not the wallet itself, but the mailing list, the shipping label, the newsletter tool behind it. The reporting on the incident is by Zack Whittaker, security editor at TechCrunch, dated 6:32 AM PDT on September 11, 2026.
What to watch next: whether Trezor names which vendors it keeps and which it drops, and whether Brevo tightens the access controls that let a handful of compromised accounts reach every organization those accounts could touch.
