Listen to the episode
TLDR
Crypto hardware wallet maker Trezor disclosed that threat actors who breached Brevo, its third party email marketing provider, used the access to send phishing emails to roughly 347,000 newsletter subscribers. About 2,500 users clicked the...
How it works
Crypto hardware wallet maker Trezor disclosed that threat actors who breached Brevo, its third party email marketing provider, used the access to send phishing emails to roughly 347,000 newsletter subscribers. About 2,500 users clicked the...
Red flags
- Unsolicited email demanding you type your 12/24 word recovery seed into any website or app. Trezor (and no legitimate wallet) will never ask for your seed. Sender address spoofing help@trezor.io from a marketing platform, not Trezor's own infrastructure. Urgency framing ("critical security alert") pressuring immediate action without verifying on the official site. Actions Never enter your recovery seed into a website, app, or form — treat it like a password, offline only. Verify any wallet alert directly by typing trezor.io into your browser
- ignore email links. Revoke and re derive wallet backups i
What to do
- 1Trezor (and no legitimate wallet) will never ask for your seed.
- 2Urgency framing ("critical security alert") pressuring immediate action without verifying on the official site.
- 3Actions Never enter your recovery seed into a website, app, or form — treat it like a password, offline only.
Source
bleepingcomputer
Source reviewed by Mythos Forensic Team
https://www.bleepingcomputer.com/news/security/trezor-347-000-users-targeted-in-phishing-attacks-after-brevo-breach/FAQ
Is Trezor phishing via Brevo breach targets 347000 crypto wallet users a real scam pattern?
Yes. Treat the message, call, or payment request as suspicious until you verify it through an official channel.
What are the first warning signs?
Unsolicited email demanding you type your 12/24 word recovery seed into any website or app. Trezor (and no legitimate wallet) will never ask for your seed. Sender address spoofing help@trezor.io from a marketing platform, not Trezor's own infrastructure. Urgency framing ("critical security alert") pressuring immediate action without verifying on the official site. Actions Never enter your recovery seed into a website, app, or form — treat it like a password, offline only. Verify any wallet alert directly by typing trezor.io into your browser; ignore email links. Revoke and re derive wallet backups i
What should I do first?
Trezor (and no legitimate wallet) will never ask for your seed.; Urgency framing ("critical security alert") pressuring immediate action without verifying on the official site.; Actions Never enter your recovery seed into a website, app, or form — treat it like a password, offline only.
Can LegalAudit check my case?
Yes. Start a free chat and paste the message, link, sender, or payment details for triage.