D’CENT and Trezor incidents have highlighted security risks beyond the hardware devices used for crypto self-custody. D’CENT is investigating unauthorized transfers affecting some users of its software-based App Wallet, while Trezor said attackers obtained 347,149 marketing contacts after breaching Brevo, a third-party provider. Neither company has reported a compromise of its hardware-wallet security. D’CENT said most reported victims used App Wallet, which can store or import keys on a phone, and is examining wallets whose recovery phrases were entered into the app and that signed transactions on versions earlier than 8.1.0, released Nov. 5, 2025. The potential exposure includes Bitcoin, Ethereum, XRP Ledger, Tron and other EVM-compatible networks. A recovery phrase generated on a D’CENT hardware device can recreate the same private keys elsewhere if manually imported into App Wallet, although normal hardware-device connections do not transfer the phrase to the phone. D’CENT is advising qualifying users to update the app, create a wallet with a new recovery phrase and move affected assets, while working with exchanges, law enforcement and blockchain investigators to trace or potentially freeze stolen funds. Trezor’s incident began with Brevo, where an attacker exploited a flaw in SAML single sign-on to access 138 customer accounts. Contacts were exported from 43 accounts, and six were used to send phishing emails through legitimate infrastructure. A message sent to Trezor contacts falsely claimed a critical hardware vulnerability and directed recipients to an application requesting their wallet backup; about 2,500 people reached the malicious domain before it was disabled. Clicking alone did not expose funds, but entering the backup could let attackers recreate a wallet elsewhere. Trezor had also disclosed a related August shipping-provider incident involving phone numbers and shipping addresses, while saying its wallets were unaffected. The episodes are likely to increase pressure on wallet companies to secure customer databases, software workflows and outside vendors alongside their devices. Trezor suspended its Brevo account and is reviewing vendor relationships and security requirements. Brevo closed the exploited SSO route, reset active sessions and said it was deploying a permanent fix restricting authentication to the organization owning each SSO configuration. D’CENT said it is adding safeguards and pre-release verification procedures as it investigates the full scope and whether moved assets can be recovered. Both incidents reinforce that once recovery phrases are entered into compromised software or disclosed through phishing, attackers do not need to defeat the hardware device.