Email Platform Breach Exposes 347,000 Trezor Subscribers to Phishing Attack

A security flaw in email marketing platform Brevo allowed an attacker to gain access to 138 client accounts, resulting in phishing emails being sent to roughly 347,000 subscribers of hardware wallet maker Trezor. Similar fraudulent messages were also distributed through accounts belonging to wallet maker BitBox and portfolio tracking platform CoinTracking.

According to Brevo’s internal review, six compromised accounts were actually used to send phishing messages, while contact data was extracted from dozens of others. The attacker reportedly created a Brevo account, enabled single sign-on access, and invited legitimate users into a shared configuration. A failure in access controls allowed that account to reach far beyond its intended scope.

Trezor Moves Quickly to Contain Damage

The phishing email, disguised as a security alert, directed recipients to a fraudulent app requesting wallet backup information. Trezor disabled the malicious domain within 20 minutes, though roughly 2,500 people had already clicked the link. The company confirmed all affected subscribers were notified and said only opt-in email addresses were stored on the platform, with no other customer data exposed.

Other Firms Report Similar Incidents

BitBox confirmed its newsletter list was also affected, though it found no evidence of stolen funds or exposed recovery phrases. CoinTracking issued a warning after a fraudulent breach notice was sent through its own Brevo account, urging users not to click any included links.