The email looked official because, in one important sense, it came through an official channel. On September 9, 2026, an attacker used access to Brevo, Trezor’s third-party newsletter platform, to send a false security alert from its account. The message warned of a wallet vulnerability and linked to an app that asked users to enter their wallet backup.
Why the message was convincing
Most phishing advice starts with the sender’s address: check the domain, look for misspellings and question unfamiliar senders. Those checks help, but they wouldn’t have caught this case. The attacker sent the message through a platform Trezor used for its newsletters, so recipients had a reason to recognize the channel.
The subject line claimed there was an “STM32 Entropy Vulnerability.” Trezor says the initial email went to roughly 347,000 newsletter addresses. About 2,500 people clicked the link before the group disabled the malicious domain, within 20 minutes of detecting the campaign. The group says its products, wallets and account systems were unaffected. It later confirmed that the Brevo breach exposed 347,149 newsletter email addresses.
The wallet backup is the line you never cross
A hardware wallet keeps the keys that control cryptocurrency away from ordinary online systems. Its recovery words, also called a wallet backup, can restore access to the wallet. That is why criminals want them.
Never enter a wallet backup on a website, in a linked form, or in a downloaded app. Trezor says it will not contact users asking for one. The rule still holds when the logo is correct, the writing is polished, and the sender looks familiar.
If you received the September 9 message, or any message, delete it without following the link. If you clicked but did not enter your wallet backup, Trezor says the click alone did not expose your funds.
If you entered the backup into the app or anywhere online, move your funds to a new wallet immediately. Reach Trezor’s official software and support channels independently; do not use links or contact details from the suspicious message.
Newsletter subscribers should also watch for follow-up attempts. Attackers may use the exported addresses in new emails referencing this real incident. Accurate background information does not make a request for your wallet backup legitimate.
The broader lesson from Trezor
Companies rely on outside providers for newsletters and other customer communications. Access to one of those providers can give an attacker a familiar delivery channel, even when the company’s products remain secure.
Organizations should limit access to those platforms, monitor unusual campaigns and prepare ways to warn customers quickly. Customers need a verification route they can reach on their own, such as the company’s official website or app.
A message can arrive through a legitimate channel and still contain fraudulent instructions. If it asks you to enter your wallet backup, stop there.
Cyber threats evolve rapidly—your team must stay prepared. Our penetration testing services provide hands-on training and real-world simulations to identify vulnerabilities before attackers do. As your trusted security partner, we craft assessments to your organization’s needs. Take a proactive approach. Schedule a consultation today at www.CybersecurityMadeEasy.com and safeguard your business.
