The Trezor phish passed DMARC. The wallet was never the problem.

The email that hit Trezor customers on the evening of September 9 carried a "Trezor Security" sender name, came from help@trezor.io, and passed every standard email-authentication check. That is the checkable fact that makes this breach worth reading past the headline: the message did not pretend to be Trezor. By every mechanical test a mail server applies, it was mail from Trezor.

It was not. It was a phishing email distributed through Brevo, the third-party marketing platform Trezor uses for newsletters. On September 9 an attacker gained access to Brevo's system and used it to send — from Trezor's own mailing infrastructure — a fake "Critical Security Alert: STM32 Entropy Vulnerability" to roughly 347,000 newsletter subscribers. About 2,500 people clicked the link before Trezor killed the domain at the DNS level, within about twenty minutes.

The authentication was the attack

This is the detail most coverage under-plays. Because the phishing email traveled Trezor's real newsletter channel, it sailed past SPF, DKIM and DMARC — the three checks that tell a mail server "this genuinely comes from the sender it claims to be." The sender field read help@trezor.io; the Return-Path read mailing.trezor.io; the malicious page lived on r.mailing.trezor.io. An attacker does not often get to borrow that identity, which is exactly why the email worked on people who know enough to distrust strangers.

The fake alert opened with a precise-sounding story: a factory defect in the STM32 microcontroller that could cause devices to generate weak 40-bit seeds, affecting roughly one in four devices. Trezor says the claim is false and has published no such advisory. The hook led recipients to a page that asked them to "verify" their xPub or enter their wallet backup — the one thing that lets a third party move funds off a hardware wallet.

Trezor was explicit that none of this touched the product: "No other Trezor system was touched", the company said, and Brevo's system holds no passwords or wallet data. Clicking the link exposes nothing; entering a recovery phrase on the cloned page is how money actually moves. Trezor also said it cannot confirm whether the address list was exported, so it is treating all 347,000 addresses as known to the attacker and reusable for future phishing.

Now put the second breach on the table

The Brevo episode is not Trezor's only vendor breach this month, and the pairing is the real pattern. In August, Trezor disclosed a breach at ShipMonk, the fulfillment company that packs and ships its devices. In early September Trezor said the scope was worse than first reported: a further 67,000 U.S. customers had their names, emails, phone numbers, shipping addresses and order numbers exposed, from orders placed between November 2019 and August 2021, pushing the known affected total past 80,000. ShipMonk, Trezor said, had "falsely reassured" it that customer data had been deleted. The damage then moved off-screen: customers reported phishing phone calls and physical letters carrying QR codes.

Vendor	What they touch	What leaked	Users	What was NOT compromised
ShipMonk	shipping / fulfillment	names, emails, phones, shipping addresses, order numbers	over 80,000	wallet, device, funds
Brevo	email / newsletter	~347,000 opt-in email addresses	~347,000	wallet, device, funds, passwords

Read those two rows together and the story is not "Trezor was hacked." The signing device and the seed-generation process held. What broke was the perimeter — the messaging and logistics layers a self-custody customer is asked to trust — twice in one month, by two different vendors, via two different attack surfaces. That is a vendor-concentration problem for the company and a recurring trust problem for the category, not a product failure.

What a retail investor actually does with this

There is no U.S.-listed Trezor equity to buy or short: the maker, SatoshiLabs, is a private Prague company. So the event's investment weight is not a stock call; it is a judgment about the self-custody category and about your own exposure. And the market is not treating it as a category event. Bitcoin traded around $77,000 in the aftermath, well below its 52-week high near $125,000, with the crypto fear/greed index neutral near 56 and bitcoin dominance high — no sign of a security-driven flight out of self-custodied coins.

The useful distinction is between the fortress and the perimeter. The fortress — the device that signs and the seed it generates — has, on this evidence, held through two attacks. The perimeter — email, shipping, update feeds — keeps being handed to attackers, and that is where a self-custody holder's real loss vector lives: not in a sophisticated exploit, but in typing a recovery phrase onto a page that a cleverly authenticated email tells you to trust. Clicking changes nothing. Typing the seed changes everything.

So the break condition to hold onto is precise. If a future incident reaches the signing device or the seed-generation process itself — not just the channel that talks to the customer — then the self-custody value proposition would need genuine re-pricing, because the one thing a hardware wallet promises is that the key never leaves the silicon. Two vendor breaches in a month have not shown that. What they show is that the messages asking for the key will keep coming, better forged, from the company's own trusted channels.