Trezor's Email Provider Suffers Data Breach, Hundreds of Thousands of Crypto Users Targeted by Scams

Hardware crypto wallet maker Trezor has confirmed that its email service provider suffered a data breach, exposing the information of hundreds of thousands of cryptocurrency holders and making them direct targets for scammers. Notably, this marks the second time a third-party service that Trezor relies on has experienced a data breach.

Incident Overview

According to disclosed information, the breach originated not from Trezor's own systems, but from a third-party email service provider it works with. Attackers obtained a large volume of user contact information through this provider and subsequently launched targeted scam campaigns against Trezor's wallet users.

What makes these attacks particularly dangerous is that scammers already know the victims' connection to Trezor, allowing them to impersonate official channels and send phishing emails designed to trick users into revealing their seed phrases, private keys, or visiting malicious websites. For crypto asset holders, a leaked seed phrase can mean funds are swept away instantly and irreversibly.

Third-Party Services as the Weakest Link

The most noteworthy aspect of this incident is that the breach occurred within Trezor's supply chain — not in the product itself. As a hardware wallet, Trezor's core security design — offline private key storage and physical transaction confirmation — remains intact. Yet users' personal information was exposed through a third-party email service.

For Trezor, this is the second time a service provider it relies on has suffered a data breach. This reflects a broader industry problem: even when a product itself is sufficiently secure, any weak link in the supply chain can become an entry point for attackers. The crypto industry's dependence on third-party marketing tools, customer support systems, and email platforms is expanding its overall attack surface.

Real Risks Facing Users

For the hundreds of thousands of affected users, the primary threat comes from social engineering attacks:

• Phishing emails: Impersonating Trezor's official communications, claiming account anomalies and urging users to "verify their wallet" or "upgrade firmware," directing them to spoofed websites.
• Fake customer support: Contacting users under the guise of helping them "protect their assets" while asking for seed phrases or manipulating them into harmful actions.
• Highly targeted attacks: Because attackers already know the victims are Trezor users, the scam content is far more convincing and believable.

It bears repeating: no legitimate wallet manufacturer will ever proactively ask for a user's seed phrase or private key. A Trezor device's seed phrase should only be generated and used locally on the device — it should never be entered into any website or email form.

How Crypto Users Should Respond

To protect against scam risks arising from this type of supply chain breach, users can take the following precautions:

1. Be skeptical of all unsolicited contact: Do not click links in emails; manually type the official URL when visiting any website.
2. Never reveal your seed phrase: Regardless of the reason given, do not enter your seed phrase into any interface.
3. Verify the sender: Carefully check email domains and watch for lookalike domains with subtle spelling differences.
4. Enable additional protections: Such as setting a PIN code and using the hidden wallet (passphrase) feature on your device.
5. Consider using a dedicated email address: For holders of high-value assets, use a separate, non-public email address for all crypto-related services.

Conclusion

This incident serves as yet another reminder to both the industry and users: crypto security depends not only on the wallet hardware itself, but on every single link in the broader service ecosystem. A hardware wallet can protect private keys from being stolen, but it cannot prevent personal user information from leaking through third-party channels. As attackers increasingly rely on precision social engineering, staying vigilant and holding firm to the principle of "never share your seed phrase" remains the last line of defense against fraud.