Incidents expose software and data risks for hardware wallets

Two separate incidents this week exposed weaknesses in the systems around crypto hardware wallets while the devices themselves remained uncompromised.

D’CENT opened an investigation after receiving reports of unauthorized transfers on Sept. 16. Most affected users had manually entered recovery phrases into the company’s App Wallet, a mobile software wallet that can store or import keys. D’CENT has not confirmed a breach of its hardware products. The company identified potential exposure for wallets whose recovery phrases were entered into the App Wallet and that recorded transaction activity on app versions older than 8.1.0, released Nov. 5, 2025. The list of potentially affected networks includes Bitcoin, Ethereum, XRP Ledger, Tron and other EVM-compatible chains. The firm advised users who meet those criteria to update the app, create a new wallet with a fresh recovery phrase, and transfer assets rather than restoring the older phrase. D’CENT is working with exchanges, law enforcement and blockchain investigators to trace and possibly freeze moved funds and is implementing additional safeguards and pre-release verification steps while the probe continues.

Trezor’s incident began after an attacker exploited a flaw in Brevo’s SAML single-sign-on configuration to access customer accounts. Brevo reported that 138 customer accounts were reached, contacts were exported from 43 accounts, and attackers used six accounts to send phishing emails through legitimate customer infrastructure. Trezor reported that 347,149 marketing email contacts were exposed. The phishing messages claimed a critical hardware vulnerability and directed recipients to download an application that requested a wallet backup. About 2,500 recipients visited the malicious domain before it was disabled. Trezor noted that clicking the link alone did not expose funds; the risk occurred if a user entered their recovery phrase into the malicious application. Following the breach, Trezor suspended its Brevo account and began reviewing vendor security. Brevo closed the SSO route used by the attacker, reset active sessions and said it is deploying a permanent fix to restrict authentication to the owning organization for each SSO configuration.

Both incidents involved the recovery phrase, the set of words that can reconstruct a wallet’s private keys. In one case, moving recovery words from a hardware-generated wallet into companion software created a pathway to the keys. In the other, exported contact lists were used to deliver convincing phishing messages that attempted to collect recovery phrases.

Investigations are ongoing. Both companies are identifying affected users and coordinating with partners to limit further loss and remediate security gaps.