Liquid

Security

An attacker exploited a flaw in email platform Brevo’s login system to access 138 client accounts, enabling a phishing email to reach roughly 347,000 Trezor newsletter subscribers and similar fraudulent messages to be distributed through accounts belonging to hardware wallet maker BitBox and crypto portfolio tracking and tax-reporting platform CoinTracking.In a Thursday postmortem, Brevo <a href="https://status.brevo.com/incidents/01M266V1CZKJQNGZRNEGFD5CQE/write-up" rel="noopener noreferrer nofollow">said</a> six accounts were used to send phishing emails, contacts were exported from 43 and 93 accounts showed no meaningful activity. The platform did not specify whether the categories overlapped.&nbsp;The attacker created a Brevo account, enabled single sign-on and invited legitimate Brevo users into the configuration. Brevo said access should have been confined to that organization, but an authorization boundary failed and granted access to every organization the invited users could reach.The disclosure expands on warnings <a href="https://ct.com/news/trezor-bitbox-hardware-wallet-phishing-emails" rel="noopener noreferrer nofollow">issued by Trezor and BitBox on Wednesday</a>, identifying their shared provider and explaining why the emails passed normal authentication checks and appeared genuine.&nbsp;Cointelegraph reached out to Brevo for more information but did not receive a response before publication.&nbsp;<h2 id="crypto-firms-assess-potential-subscriber-exposure">Crypto firms assess potential subscriber exposure&nbsp;</h2>In a blog post, Trezor <a href="https://trezor.io/blog/news/security-incident-at-brevo-our-third-party-email-provider" rel="noopener noreferrer nofollow">said</a> the phishing message, titled “Critical Security Alert: STM32 Entropy Vulnerability,” contained a link to an app that requested users’ wallet backups. The company disabled the domain at the DNS level within 20 minutes, but about 2,500 people accessed the link before the takedown.A Trezor spokesperson told Cointelegraph that “the initial email was sent to 347,000 customers,” all of whom were subsequently contacted about the risk. The company’s Brevo account stored only opt-in newsletter email addresses and no other customer data.“Until we hear more from Brevo, we are treating all roughly 347,000 newsletter addresses as known to the attacker and possibly reusable for phishing,” the spokesperson said.Related: <a href="https://cointelegraph.com/news/liquid-network-resumes-block-production-after-320m-exploit" rel="noopener noreferrer nofollow">Liquid Network resumes block production after $320M exploit</a>A BitBox spokesperson told Cointelegraph that its unauthorized email was sent through Brevo and appeared to have reached its full newsletter and tutorial list.&nbsp;BitBox said Brevo held only email addresses and language preferences. It found no evidence of compromised company credentials, downloaded contacts, lost funds or disclosed recovery phrases, but is treating the list as potentially accessed while awaiting Brevo’s logs.Meanwhile, CoinTracking <a href="https://x.com/Coin_Tracking/status/2097800407103783325" rel="noopener noreferrer nofollow">said</a> its Brevo account distributed an email titled “Data Breach Notice: Please refresh API Keys as soon as possible.” It warned recipients not to follow the email’s links.Magazine: <a href="https://cointelegraph.com/magazine/10-of-the-greatest-unsolved-crypto-mysteries" rel="noopener noreferrer nofollow">10 of the greatest unsolved crypto mysteries</a>

Brevo login flaw enabled phishing email targeting 347K Trezor subscribers

Table of Contents

Cointelegraph

Other articles published on Sep 11, 2026

Crypto Prices on September 11: BTC 1.79%↓, RAY 28.38%↑

Sam Bankman-Fried Appeals Fraud Conviction to Supreme Court

India launches digital rupee settlement for bonds

Bitwise Pulls The Plug on its Dogecoin ETF

Tim Draper Predicts a Bitcoin Rush if Retailers Reject Dollars

Hyperliquid auctions the right to list a token every 31 hours

Join our free newsletter for daily crypto updates!