Brevo Flaw Exposed 347K Trezor Subscribers to Phishing

Trezor said a flaw in Brevo’s login system enabled attackers to send phishing emails to 347,000 subscribers, creating a fresh security risk for users of the hardware wallet maker’s mailing list.

The company said it is treating every exposed address as known to the attacker and potentially reusable in future phishing attempts. That assessment matters because email exposure can be enough to support convincing impersonation campaigns, even when no wallet keys or funds are directly compromised.

The incident underscores a persistent weak point in crypto security: attackers often target the communication layer rather than the blockchain itself. For hardware wallet users, a credible email that appears to come from a trusted brand can be used to push malicious links, fake support requests or seed-phrase theft attempts.

Trezor’s warning also highlights the broader operational risk tied to third-party service providers. Even when a crypto firm’s core products remain secure, a breach in a marketing or customer-communications platform can expand the attack surface and increase the odds of downstream fraud.

Investors and users should treat any unsolicited message referencing wallet security, firmware updates or account verification with caution. The safest response remains to verify communications through official channels and avoid clicking links embedded in emails.