## You buy a hardware wallet because you want more control over your crypto. Then a convincing security email arrives, or news breaks about devices purchased through a trusted reseller. Suddenly, the question becomes bigger than whether your wallet has a secure chip. September’s Trezor email-provider breach and the developing Ledger–CryptoBilis investigation show why self-custody requires several layers of protection. The incidents involve different attack routes, but both raise questions about the *companies, communications, and distribution channels* users depend on. There is no established evidence that the same attackers carried out both incidents. Their connection is the safety lesson: ***protecting your crypto requires protecting the entire path to your keys.*** --- ## What happened to Trezor? On September 9, 2026, attackers accessed Brevo, the marketing platform Trezor used for newsletters. They used that access to distribute phishing messages through customer accounts, including Trezor’s. Trezor’s September 17 update confirmed that **347,149**marketing email contacts had been exported. The company said no other Trezor system was affected. This was an email-provider breach; it did not establish that Trezor hardware wallets or their private keys had been compromised. The practical danger was the credibility of the message. A security warning arriving through a familiar communication channel can persuade someone to follow instructions they would otherwise question. There was also a separate Trezor-related incident involving shipping provider ShipMonk. Initially disclosed in August and expanded on September 4, it exposed customer order information, with approximately 67,000 additional U.S. customers included in the update. That incident should not be confused with the Brevo breach. Because the emails went out through Brevo's legitimate infrastructure under Trezor's account, they passed SPF, DKIM, and DMARC — the authentication checks that are supposed to catch forged senders. Technically, the messages were indistinguishable from authentic Trezor communications. The Trezor team sincerely apologized to all affected and promised to continue handling the incident and providing event updates. --- ## What happened to Ledger users? On October 9, Ledger disclosed an investigation into reported losses affecting users in Southeast Asia who bought devices from [CryptoBilis](https://www.cryptobilis.com/). Ledger asked the reseller to suspend sales and shipments. An October 10 update confirmed an unauthorized hardware implant inside one affected user’s device. That is a significant finding, but it does not establish the full scope of tampering or explain every reported loss. Ledger had not confirmed the circulating aggregate loss estimates. Ledger’s initial advice covered customers who bought from CryptoBilis during the preceding 90 days: ***do not initialize an unused device***; if already initialized, consider moving assets to a new signer with a newly generated recovery phrase.  The distinction matters. An investigation involving a particular distribution channel is not evidence that every Ledger device has been compromised. Equally, confirmation of physical tampering deserves more attention than a generic reminder to avoid suspicious links. To be fair, Ledger and Trezor are the biggest hardware wallet providers, but are not the only wallet providers affected in 2026 alone. As crypto goes mainstream, security is not an after thought. It should define every crypto decision you make. --- ## Five habits that reduce your exposure ### 1.Verify alerts through a separate route. When an alarming message arrives, close it and independently open the manufacturer’s official website or your already-installed official application. Check whether the advisory exists there. Always bookmark frequently viisted sites. Avoid using the message’s links, QR codes, attachments, or contact details to verify the message itself. [Trezor](https://trezor.io/learn/security-privacy/personal-security-standards/scams-and-phishing) warns that professional-looking emails, calls, and even convincing impersonations can be scams. Appearance is not authentication. ### 2.Know where your device came from. Keep the receipt, seller name, purchase date, and order details. These records help you determine whether a future advisory applies to you. Buying directly from a manufacturer can reduce intermediary exposure. If you use a reseller, verify its status through the manufacturer and check current incident notices. An authorized listing is useful information, but it cannot guarantee everything that happened to an individual device. ### 3.Understand what an authenticity check proves. Run the manufacturer’s recommended checks using genuine software. However, do not assume a successful check proves every physical component is untouched. Ledger’s own buying guidance states that Genuine Check confirms authenticity but cannot verify a device’s physical supply-chain history. That limitation matters when an advisory concerns hardware tampering. A familiar setup screen, intact packaging, or successful check should not override a specific warning about your seller or device.[](https://cryptostoicmedia.com/) ### 4.Keep recovery words out of unsolicited interactions. Do not send them to support, enter them into an emergency verification page, or share them with someone offering to rescue your funds. Be equally cautious about unexpected transactions. A scam may seek your signature instead of your recovery phrase. [Read](https://www.ledger.com/ongoing-phishing-campaigns) the transaction details on a trusted device and reject requests you did not initiate or cannot understand. ### 5.Prepare before there is an emergency. Know how to reach official support without relying on search advertisements or social-media replies. Keep purchase records somewhere accessible. Understand your backup and recovery process before you need it. A short written plan can prevent rushed decisions: *identify the affected device, verify the advisory, establish a trusted destination, and preserve evidence.* Planning reduces the chance that the first convincing stranger becomes your emergency adviser. If you think you are affected. match your response to what happened. --- Receiving a phishing email does not, by itself, mean your recovery phrase was stolen. Stop interacting with it and verify the incident independently. Downloading software, sharing recovery words, or approving a transaction requires a more urgent assessment. If your recovery phrase may be exposed, protecting remaining funds requires a destination based on a new, securely generated phrase. Restoring the old phrase on a replacement device restores the same keys; it does not revoke an attacker’s copy. Ledger’s recovery guidance describes transferring assets away from potentially compromised accounts and creating new ones. [Here](https://x.com/cz_binance/status/2108993085266919920) is a useful article from CZ - founder of Binance. If physical tampering is suspected, do not generate that new phrase on the questionable device. Do not assume a factory reset removes an unauthorized implant. Follow verified incident instructions and obtain help through support channels you open yourself. Hardware wallets remain an important security tool, but ownership alone is not a complete safety strategy. These incidents make the surrounding responsibilities clear: *verify communications, understand device provenance, protect recovery secrets, and respond to the specific exposure.* The strongest habit is simple: ***when someone tells you to act urgently to protect your crypto, independently verify both the warning and the proposed action.***