Scammers target hundreds of thousands of crypto owners after Trezor confirms data breach of email provider

Your crypto wallet backup password is now at greater risk of being stolen through phishing. These attacks are targeting both email and physical mail, increasing the urgency to secure your recovery phrase. You should verify all communications from Trezor and avoid clicking links or downloading apps from unsolicited sources.

Hardware wallet maker Trezor has confirmed a data breach affecting its email marketing provider, Brevo. Hackers accessed 138 Brevo accounts, using them to send approximately 347,000 phishing emails to Trezor customers. These emails contained a malicious link designed to download an app that requests the user's wallet backup password. Trezor stated that its own products, wallets, and account systems were not compromised. This incident follows a previous breach in August where Trezor's shipping partner, ShipMonk, exposed the personal data of at least 81,000 customers, leading to further phishing attempts via mail. Trezor is reviewing its vendor relationships and warning customers about potential future phishing attacks.

This incident underscores the persistent vulnerability of the cryptocurrency ecosystem to third-party data breaches. By compromising Brevo, attackers gained access to a direct communication channel with Trezor users, bypassing traditional security measures. The success of such attacks highlights the critical need for robust vendor risk management, as a single weak link in a supply chain can expose a large customer base to significant financial risk. Trezor's acknowledgement of potential future attacks suggests a need for enhanced customer education and vigilance.

The dual nature of these recent breaches—one via email and another via shipping data leading to physical mail scams—demonstrates an evolving threat landscape for crypto owners. Attackers are leveraging compromised customer data across multiple vectors to impersonate trusted brands like Trezor and trick users into revealing their private keys. This pattern suggests that customers of hardware wallets and other high-value digital asset services will need to maintain a heightened state of alert against increasingly sophisticated social engineering tactics.