A run of incidents involving Ledger, Trezor, Bitget and MetaMask has exposed security weak points beyond private-key theft and smart-contract exploits, from altered hardware and hijacked email systems to privileged access inside operational infrastructure. In each case, the attackers targeted the services, delivery routes or internal controls surrounding crypto products rather than directly breaking the cryptography protecting wallets.
Ledger said its security team examined a hardware wallet that passed the company’s “Genuine Check” but had been physically modified to capture a user’s recovery phrase. Investigators found an additional malicious electronic module installed inside the device’s casing.
According to Ledger’s review, the implant could record the recovery phrase as it appeared on the wallet’s screen during initial setup. It was designed to send the information to an attacker through a cellular connection. A recovery phrase gives whoever possesses it the ability to restore and control a wallet, making a compromised setup process especially dangerous even if the device’s normal security architecture remains intact.
Ledger did not report a compromise of the wallet’s secure element or its official firmware. The case instead points to physical tampering after manufacturing, where a device can retain enough authentic components to pass checks focused on chip identity and firmware integrity.
Hardware checks have limits after delivery
The Ledger case places added attention on the period between production and delivery. A genuine device can be altered in transit, during resale, or through an unauthorized distributor, leaving users with an apparently legitimate product whose physical components have changed.
Authenticity tools remain useful for confirming that a device runs approved software and includes recognized hardware. They cannot necessarily identify every added component hidden inside a casing. Users receiving a new hardware wallet therefore face a more practical inspection task: checking for damaged seals, inconsistent packaging, unusual glue or casing marks, and any other indication the product has been opened.
The safest setup process also remains one in which the recovery phrase is generated by the device itself and never entered into a website, mobile application, or form prompted by an email. A phrase displayed during setup should be treated as the wallet’s master credential, not as information a support team or security alert would ever require.
Trezor phishing campaign followed Brevo access breach
Trezor users faced a different form of exposure after attackers gained unauthorized access to accounts on Brevo, the third-party email marketing platform involved in the company’s communication workflow.
The phishing emails carried the subject line “Critical Security Alert: STM32 Entropy Vulnerability” and were sent through normal mailing infrastructure connected to the Trezor brand. Their apparent legitimacy was central to the attack: recipients were directed to download a malicious application and submit their wallet backup details.
Brevo said attackers exploited a permission-boundary flaw in its single sign-on system. The weakness allowed unauthorized access to other customer accounts, Brevo said, affecting 138 customer accounts. Some compromised accounts were used to send phishing emails or export contact data.
Trezor later confirmed that 347,149 marketing email contact addresses were exported during the incident. Neither Trezor’s hardware wallets nor the private-key protections within them were reported as breached.
The episode demonstrates how a message sent from an expected domain or through a familiar newsletter channel can still be malicious when the distribution platform has been compromised. Checking the precise sender address can catch some impersonation attempts, but it may not protect users when attackers gain access to a legitimate sender’s infrastructure. Opening a wallet provider’s official website directly, rather than following a security-alert link in an email, provides a safer way to verify urgent claims.
Bitget says privileged credentials enabled $388 million theft
Bitget disclosed a far larger financial loss on Sept. 24, when unauthorized transfers from portions of its hot and warm wallets led to the theft of about $388 million in assets.
The exchange’s published investigation said the attackers exploited a vulnerability in a third-party security product, obtained high-privilege internal credentials, and then accessed wallet-related backend systems. From there, they were able to forge withdrawal instructions and evade existing risk controls, according to Bitget.
Bitget said it found no private-key leakage and that its cold wallets were not affected. The reported path of the attack places the failure in authorization and transaction-validation systems: attackers allegedly gained sufficient internal access to make fraudulent withdrawal instructions appear valid to automated processes.
That distinction has practical consequences for platforms holding customer funds. Protecting private keys remains essential, but wallet operations also depend on the systems that approve transfers, assign staff permissions, monitor anomalous activity, and connect outside security tools to internal infrastructure. A high-privilege credential can become as consequential as a key if it lets an attacker influence those workflows.
Users cannot audit an exchange’s internal access controls themselves. They can limit exposure to an exchange-side incident by keeping only actively traded balances on online platforms and using self-custody for funds that do not need to be immediately accessible.
MetaMask exits affected validators as a precaution
MetaMask reported a separate infrastructure-related security issue in late September and said on Oct. 1 that it had exited some affected staking validators as a precaution.
The company said it had found no signs that MetaMask wallets or customer funds were affected. It also stated that its staking service does not manage customers’ withdrawal keys, separating the validator issue from control over users’ assets.
The preventive validator exits show that infrastructure problems can affect service operations even where customer wallet keys remain outside the affected system. Staking users may encounter operational changes when providers isolate systems, patch infrastructure, or remove validators from service to contain a potential issue.
Hacken’s third-quarter 2026 data illustrates the financial scale of attacks linked to outside dependencies. The cybersecurity firm reported that external vendor issues accounted for roughly $906 million of the $1.18 billion in total digital-asset losses during the quarter. It said September alone recorded more than $742 million stolen across platforms, the largest monthly total of the year.
Taken together, the incidents place more weight on controls around crypto products: secure delivery chains for hardware, limited permissions for external vendors, independent monitoring of high-risk internal actions, and communication channels that do not rely on email links for urgent security instructions. The cryptography can remain intact while a compromised process around it creates a route to stolen funds or recovery phrases.
For more ways to protect wallets from phishing and tampering, read crypto safety standards every trader should know today.
Disclaimer: The content on this page is provided for general informational purposes only and does not represent the views or financial advice of Toobit. We make no guarantees regarding the accuracy or completeness of this information and shall not be held liable for any errors, omissions, or outcomes resulting from its use. Investing in digital assets involves risk; users should independently evaluate their financial situation and the risks involved. For further details, please consult our Terms of Service and Risk Disclosure.
