Trezor confirmed that attackers used its Brevo newsletter account to send a phishing email to approximately 347,000 subscribers on September 9, 2026. The message falsely claimed that an STM32 microcontroller defect could produce weak 40-bit wallet seeds and directed recipients to a fraudulent page that in some cases requested an xPub. The email passed SPF, DKIM and DMARC checks because it was sent through Trezor's legitimate newsletter infrastructure. Trezor detected the campaign shortly after transmission, took the phishing domain offline within 20 minutes, disconnected Brevo, disabled email sending and contacted all recipients. The company said the Brevo account contained opt-in newsletter email addresses only, though it cannot determine whether attackers exported the list. Trezor said its hardware wallets, Trezor Suite and internal systems were not involved, and reiterated that it never asks users for wallet backups or recovery phrases. BitBox separately said its newsletter provider was very likely compromised in a related phishing wave affecting several Bitcoin companies.