Trezor's Brevo breach: your email vendor can send as you

On September 9, roughly 347,000 Trezor newsletter subscribers got a convincing security warning from Trezor. It was not from Trezor. An attacker got into Brevo, the third-party email platform Trezor uses, and sent the phishing campaign through Trezor's own account. SPF, DKIM, DMARC — all of it passed, because the mail was genuinely sent by Trezor's email service provider. That is the detail every operator running a list should sit with.

What actually happened

Per Trezor's own notice, an unauthorized actor reached Brevo's system and used it to send mail from various customer accounts — 120 Brevo accounts in total. The message carried the subject "Critical Security Alert: STM32 Entropy Vulnerability," claimed a hardware flaw in the microcontrollers used in Trezor wallets, and pushed recipients to download an app that asked for their wallet backup.

Trezor's response was fast: the phishing domain was killed at the DNS level within about 20 minutes, the Brevo account was suspended, and warnings went up across their channels. Roughly 2,500 people clicked before the domain went down, per BleepingComputer. No Trezor product, wallet, or account system was touched.

This is the second vendor incident at Trezor in a month. We wrote about the ShipMonk fulfillment breach in August. Different vendor, different data, same perimeter problem.

Why your ESP matters more than your mail server

Most small operators think about their email vendor as deliverability plumbing. It is not. It is a sending identity you have delegated, and it carries your domain's entire accumulated trust. When it is misused, none of your authentication records help — they certify the sender, and the sender was legitimate.

Four things worth doing this week.

Turn on SSO and enforce MFA in the ESP itself. Treat that console like your bank, not like a marketing tool. Audit who still has a login from a role they left.

Cap the blast radius. Most platforms let you limit sending volume, restrict which lists an account can address, and require approval before a broadcast goes out. Defaults are usually wide open.

Pre-write the correction. Trezor's 20 minutes was good because somebody had thought about it in advance. Decide now who kills the domain, who posts the notice, and where it goes — status page, social, banner on the site.

Set the expectation before you need it. Tell customers in advance that you will never ask for credentials, seeds, or payment details over email. A one-line standing promise makes the fake obvious.

Twenty minutes, roughly 2,500 clicks. That ratio is what a fast response buys you. The slower version of this story costs you the list.

Sources: Trezor: Security incident at Brevo, our third-party email provider, BleepingComputer: Trezor: 347,000 users targeted in phishing attacks after Brevo breach.