Incidents
Trezor’s Brevo email breach: what was exposed
By Jolly Ledger editorial · Published · Reviewed · 3 min read
Event date: 9 September 2026; scope updated 17 September 2026
Dated incident snapshot. Editorial review: 27 October 2026. This explainer reflects sources reviewed on that date. Open the original notice for subsequent updates before acting.
Short answer
Trezor’s 17 September update says 347,149 newsletter email contacts were exported through Brevo. Trezor says its other systems were not affected; the email’s claimed “STM32 entropy vulnerability” was the phishing lure, not an established hardware flaw.
This was a September incident, reviewed here on 27 October 2026. Trezor’s notice concerns Brevo, the third-party platform it used for newsletter campaigns. Keeping the dates and systems separate avoids turning an email-provider breach into an unsupported claim about hardware wallets.
The confirmed scope
Trezor first described a newsletter list of roughly 347,000 addresses. Its 17 September update states that Brevo confirmed 347,149 marketing email contacts were exported through the API. The later figure confirms export, not merely that addresses could have been viewed.
Trezor says no other Trezor system was touched and that the Brevo system held no passwords or wallet data. Newsletter membership is not a list of verified wallet owners or balances. Still, an exported address can be used for future targeted messages. BitBox separately reported that its own newsletter contacts at the same provider were exposed.
The vulnerability claim was the lure
The malicious email claimed an “STM32 entropy vulnerability” and linked to an app that asked for the user’s wallet backup. That claim was part of the phishing message, not a verified hardware finding. Repeating the subject line without that distinction gives the attacker’s story undeserved authority.
Trezor reports the attacker used its Brevo account to send the message. That is why an apparently official sender can still carry phishing. A familiar sending address never makes a request for recovery words legitimate.
What recipients can do for free
- Delete or report the phishing message without using its links.
- Go to Trezor’s site yourself and read the current incident guidance.
- Record whether you only received the email or also downloaded, installed, entered information or approved something.
- If you disclosed recovery words, use verified Trezor support and its official guidance for a compromised backup urgently.
- Never send a backup or passphrase to someone offering incident assistance.
Do not replace evidence with urgency
A leaked email address is a privacy exposure, not possession of your signing keys. An unchanged balance does not prove a disclosed backup remains secret, either. Start with what happened after the click and read how data leaks differ from key theft.
Sources
- Security incident at Brevo, our third-party email provider — TrezorIncludes the 17 September 2026 confirmation of exported contacts.
- Email address exposure at newsletter provider Brevo — BitBox
Reported facts are attributed to their sources. Spotted an error? Read our corrections approach.
Prepare for the next disruption
This checkup cannot diagnose a current compromise or tell you whether funds are at risk. It helps you prepare: backups, official instructions and a family briefing.
Start the free preparation checkup