Bought a cold wallet? Heads up—don’t fall for a phishing email. Today, Trezor issued a warning: their email outsourcing provider, Brevo, got hacked. Attackers used Trezor’s official domain to send phishing emails to 347,000 customers, tricking them into downloading a 'new app' and entering their wallet backup. The domain was shut down in 20 minutes, but about 2,500 people still clicked the link. 1. A company selling security products has had three incidents in just over a month—ridiculous. Last month, their shipping partner ShipMonk leaked data on 11,742 customers. Then last week, 67,000 U.S. customers’ phone numbers and delivery addresses were exposed. Scammers now know where you live and how many devices you’ve bought. 2. The chips weren’t compromised this time—the money was lost when people entered their seed phrases themselves. A friend of mine got a call from 'Ledger customer service' back in 2021, read out all 24 words, and lost 3 ETH the next day. The hardware wallet was still sitting in the drawer. If you clicked the link and entered your backup, your money is already gone. Trezor won’t reimburse a single cent.