About 347,000 Trezor customers opened their inboxes to an email headed “Critical Security Alert: STM32 Entropy Vulnerability.” It was a fake. Trezor, the hardware crypto wallet maker, told customers on Thursday that an attacker had sent the phishing messages through Brevo, the third-party marketing platform it uses.
The email carried a link to a malicious website. Trezor has not described the site, but warned that anyone who clicked and entered their wallet backup could lose their funds. Only about 2,500 users clicked, the company said, and the site was taken offline 20 minutes after the incident was detected. How many people lost money, and how much, is unclear.
How the attacker got in
Brevo has given its own account. The attacker created a Brevo account, turned on single sign-on, and invited real Brevo users into that setup. Using an identity provider they controlled, the attacker could then sign in as those users. That alone is how SSO is meant to work, Brevo said. The flaw was in the scope: the access “wrongly granted the attacker access to all organizations those users could reach,” rather than just the one where SSO was enabled.
The attacker sent phishing messages to email addresses stored in six of the compromised accounts, and took contacts out of 43 accounts. Trezor’s list was one of those abused. Swiss Bitcoin hardware wallet maker BitBox and crypto tax calculator CoinTracking also appear to have been hit, but neither has shared details of the impact or named Brevo as the cause.
A second blow in weeks
For Trezor owners, this is the second scare in under a month. The company earlier admitted that the personal information of nearly 14,000 people was exposed in a breach at its shipping provider, ShipMonk. An update on September 4 said the leak reached an additional 67,000 US customers, including their name, email, shipping address, phone number and order number.
Both incidents could feed a surge of phishing aimed at Trezor customers. Anyone who holds a wallet from the company should treat unexpected emails about wallet security with suspicion, however official they look.
