Was Trezor hacked? The 2024, 2025 and 2026 incidents

Purchase data helps deliver a parcel, a newsletter database distributes messages, and private keys authorise transactions. These are different surfaces. Exposed names, emails or addresses can support phishing, impersonation and personal risk without themselves revealing a recovery backup. Saying keys were not exposed does not make leaked physical addresses unimportant.

This timeline separates reported facts, researchers’ demonstrations and their limits. It does not attribute every social-media loss report to one incident or certify an individual device. For your case, ask which information or capability was compromised, whether you interacted with the attack and which response fits. Exchange custody versus a personal wallet separately explains control of keys.

In January, Trezor reported unauthorised access to a third-party support portal. It described potential name or nickname and email exposure for up to 66,000 contacts, with 41 users directly approached by the attacker. Those are potential contacts and identified messages, not 66,000 drained wallets or 41 verified losses. The reported scope was not device key extraction.

In March, the official X account published fraudulent messages following phishing. The statement on the 21st describes a fake invitation and application authorisation that enabled posting on its behalf. An authentic channel can distribute scams after its permissions are compromised. Trezor said its products were unaffected; following a fraudulent link from that account was not therefore safe.

In June, a team response on the official forum explained messages generated by abusing support requests. According to that explanation, attackers inserted a fraudulent subject into a request so the victim received an automated reply. The June 24 response said internal systems, data and infrastructure were not accessed. That conclusion belongs to the published explanation; it does not make the received instruction legitimate.

Separately, Trezor published Ledger Donjon’s Safe 3 evaluation on March 5, following the original November 2024 report. It demonstrated bypassing authenticity and firmware-hash checks under specialised physical attack. Trezor said researchers did not extract a private key or PIN from the evaluated device and distinguished Safe 5’s microcontroller. This is a real finding whose scope should not be obscured by phishing incidents.

A laboratory demonstration requires examining model, revision, physical access, tools and remaining protections. It establishes neither mass remote compromise nor impossibility of tampering. Owners should consider device provenance, authenticity checks, software obtained through official routes and physical control. Do not install an emailed “fix” simply because it references a genuine finding.

On June 3, Ledger Donjon, Tropic Square and Trezor published analyses. Donjon described laser fault injection bypassing signature verification and executing unauthorised firmware on TROPIC01. The chip maker described expanded investigation of internal security boundaries and mitigations. This is a genuine physical vulnerability, not the invented text of an email campaign.

Trezor distinguishes the standalone chip from its Safe 7 integration and says compromising it alone does not reveal the PIN, backup or funds because of independent device layers. Tropic Square’s scenario requires physical possession and specialised equipment, and it reported no evidence of exploitation in the wild. These are scoped, attributed conclusions rather than a universal guarantee about every model or future attack.

Do not confuse a component manufacturer’s mitigations with instructions to modify the wallet yourself. A chip advisory does not prove your unit was exploited or that an external app can test it by receiving the seed. Practical action depends on model and official product instructions, not an urgent link using words such as vulnerability or verification.

Trezor disclosed ShipMonk on August 13 after notification on the 10th, expanding scope on September 4 to include older orders. The updated FAQ gives 80,689 affected customers. We do not add initial and later figures as necessarily independent groups. Exposed addresses and phones can enable letters, calls and targeting rather than just spam. Trezor says this provider breach did not affect its devices or systems.

Brevo’s incident occurred September 9; Trezor posted on the 10th and updated the exported-contact total to 347,149 on the 17th. The newsletter channel distributed a message invoking a supposed STM32 entropy vulnerability and leading to an app requesting the backup. That claim does not establish a new STM32 flaw. Trezor reported 2,500 clicks before blocking the destination; clicks are not confirmed losses or a count of drained victims.

• If you only received a message, avoid urgent links and never disclose the backup. Open official channels independently to check the notice.
• If you opened a link or downloaded software, do not enter secrets or connect the wallet to verify it; inspect what was installed or authorised.
• If you disclosed the backup, treat it as compromised. Official guidance calls for moving assets to a wallet with a new independent backup through a trusted environment.
• For unexplained movements, retain addresses, TXIDs, times and messages for support and appropriate reporting without publishing secrets.

Changing a PIN or updating firmware does not revoke a recovery backup already held by an attacker. Do not erase your only access before preparing and verifying a safe destination. Responding to exposure means checking the new wallet and receiving addresses, not following a privately messaged “migration service.” Withdrawing to a personal wallet covers network and receiving checks; account security separately covers platform access.

These sources do not establish a consolidated loss total across all incidents. That absence neither proves nobody fell victim to phishing nor justifies attributing a social-media figure to a device hack. Preserve the distinctions: personal data, compromised channels, deception and physical vulnerabilities. This page keeps the chronology together rather than multiplying headlines that blur those facts.