Trezor Says 347,000 Users Were Targeted After Brevo Breach

Trezor has reminded crypto users of an uncomfortable truth that a hardware wallet can protect private keys, but it cannot protect people from every weak point around the product.

The hardware wallet maker says a breach at Brevo, its third-party email provider, was used to send phishing emails to 347,000 subscribers. The company said the incident affected email addresses used for marketing communications, while wallet funds and recovery phrases were not exposed. Trezor’s own incident note on the Brevo breach says the phishing emails were sent on September 9, 2026, and security researchers later reported that about 2,500 users clicked the malicious link.

That distinction is important, but it should not make users relaxed. In crypto, an email address is not just an email address. It can become the starting point for fake wallet alerts, seed phrase scams, support impersonation and social engineering. Attackers do not need to break into a hardware wallet if they can persuade a user to hand over the recovery phrase.

The phishing campaign reportedly used Trezor’s own sending domain through the compromised email provider, which makes the attack more dangerous than a random fake email from a strange address. Users are more likely to trust a message that appears to come through a legitimate brand channel, especially when the message uses urgent language about a wallet or chip security issue.

Trezor has warned users not to enter wallet backup words, recovery phrases or private keys into any website or form. That advice may sound basic, but it is still the line that separates a scare from a total wallet loss. Hardware wallets work because the private keys stay offline and transactions are verified on the device. The moment a recovery phrase is typed into a phishing page, the protection is effectively gone.

This incident also shows why companies that handle sensitive customer communities have to treat marketing platforms as part of their security perimeter. A breached email provider can create the same kind of trust crisis as a direct company breach because the customer experiences it through the brand.

The lesson for crypto users is simple. Do not click wallet security links from email. Open the official app or website directly, verify announcements through official channels and never share recovery words with any person or platform. TechBooky has been tracking how cyber risk is becoming a business issue across finance, including the recent warning that banks and fintechs can lose public trust quickly when security slips. Crypto companies face that same trust test, only faster.