Security

2026

Simply

Impact

<h3 id="key-points">Key Points</h3><ul><li>An authentication vulnerability in Brevo’s email platform enabled unauthorized entry into 138 customer accounts</li><li>Approximately 347,000 Trezor newsletter recipients were sent phishing messages with fraudulent links</li><li>The incident also impacted BitBox and CoinTracking through their respective Brevo accounts</li><li>Roughly 2,500 individuals accessed the malicious link before Trezor disabled the domain in under 20 minutes</li><li>Trezor confirms that wallet information, login credentials, and product infrastructure remained secure</li></ul><p>An authentication weakness in the Brevo email marketing service enabled a malicious actor to compromise 138 customer accounts and distribute phishing messages to hundreds of thousands of cryptocurrency holders.</p><div class="embed-x"><blockquote class="twitter-tweet"><p><img src="https://s.w.org/images/core/emoji/17.0.2/72x72/1f6a8.png" alt="🚨" class="wp-smiley" style="height: 1em; max-height: 1em;"> SECURITY WARNING <img src="https://s.w.org/images/core/emoji/17.0.2/72x72/1f6a8.png" alt="🚨" class="wp-smiley" style="height: 1em; max-height: 1em;"></p><p>Brevo (formerly Sendinblue) has reportedly been compromised. Phishing emails impersonating CoinTracking, Trezor and BitBox and likely several others in the industry are currently making the rounds.</p><p>DO NOT:<br><img src="https://s.w.org/images/core/emoji/17.0.2/72x72/274c.png" alt="❌" class="wp-smiley" style="height: 1em; max-height: 1em;"> Click any links<br><img src="https://s.w.org/images/core/emoji/17.0.2/72x72/274c.png" alt="❌" class="wp-smiley" style="height: 1em; max-height: 1em;"> Download attachments<br><img src="https://s.w.org/images/core/emoji/17.0.2/72x72/274c.png" alt="❌" class="wp-smiley" style="height: 1em; max-height: 1em;">… <a href="https://t.co/yW30XrNV1R" rel="noopener noreferrer nofollow">pic.twitter.com/yW30XrNV1R</a></p><p>— Coinjoined Chris <img src="https://s.w.org/images/core/emoji/17.0.2/72x72/26a1.png" alt="⚡" class="wp-smiley" style="height: 1em; max-height: 1em;"> (@coinjoined) <a href="https://x.com/coinjoined/status/2097788421305491513?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">September 9, 2026</a></p></blockquote></div><p>The security incident impacted <a href="https://trezor.io/blog/news/security-incident-at-brevo-our-third-party-email-provider" rel="noopener noreferrer nofollow">Trezor</a>, BitBox, and CoinTracking, which all relied on Brevo’s platform for managing their email subscriber databases.</p><h3 id="the-exploitation-method">The Exploitation Method</h3><p>The threat actor established a Brevo account, activated single sign-on functionality, and sent invitations to genuine Brevo users to join the configuration. A critical authorization boundary weakness subsequently provided the attacker with access to all organizations those invited users had permissions for.</p><p>Brevo’s subsequent investigation revealed that six compromised accounts were utilized to distribute phishing communications, 43 accounts had contact lists extracted, and 93 accounts displayed no significant unauthorized activity.</p><p>The campaign was engineered to circumvent standard email verification protocols, causing the fraudulent messages to appear legitimate to those who received them.</p><h3 id="the-phishing-message-campaign">The Phishing Message Campaign</h3><p>Trezor’s database of 347,000 newsletter recipients was sent an email with the heading “Critical Security Alert: STM32 Entropy Vulnerability.”</p><p>The message included a hyperlink directing users to a counterfeit application designed to capture wallet recovery phrases, providing attackers complete control over victim funds.</p><p>Trezor deactivated the fraudulent domain through DNS-level intervention within 20 minutes of identifying the unauthorized email. Approximately 2,500 recipients had already accessed the link during that window.</p><p>Trezor has verified that its Brevo account contained exclusively opt-in newsletter email addresses. No login credentials, wallet information, or additional personal data was maintained on the platform.</p><p>The organization is now considering all 347,000 addresses as potentially compromised and vulnerable to subsequent phishing campaigns.</p><h3 id="impact-on-bitbox-and-cointracking">Impact on BitBox and CoinTracking</h3><p>BitBox reported that the fraudulent email was delivered to its complete newsletter and educational content subscriber base via Brevo. The company’s investigation found no indication of extracted contact databases, compromised funds, or exposed seed phrases.</p><p>BitBox verified that its Brevo account stored exclusively email addresses and user language preference settings.</p><blockquote><p>CoinTracking’s Brevo infrastructure was exploited to distribute a message with the subject line “Data Breach Notice: Please refresh API Keys as soon as possible.” The organization cautioned subscribers against interacting with any hyperlinks contained in that communication.</p></blockquote><p>Trezor has deactivated its Brevo account and implemented alert notifications throughout its website, mobile application, and customer support platforms.</p><p>If you provided your wallet recovery phrase after accessing the fraudulent link, Trezor recommends transferring assets to a newly generated wallet without delay. Simply clicking the link without submitting information does not compromise your cryptocurrency holdings.</p><p>Trezor has announced it is conducting a comprehensive evaluation of its third-party service providers and security protocols in response to this incident.</p><p>The post <a href="https://blockonomi.com/brevo-security-breach-exposes-347000-trezor-users-to-phishing-attack/" rel="noopener noreferrer nofollow">Brevo Security Breach Exposes 347,000 Trezor Users to Phishing Attack</a> appeared first on <a href="https://blockonomi.com" rel="noopener noreferrer nofollow">Blockonomi</a>.</p>

Brevo Security Breach Exposes 347,000 Trezor Users to Phishing Attack

Table of Contents

Blockonomi

Other articles published on Sep 11, 2026

Crypto News September 11: Bitcoin Falls To $77K Amid Regulation Change

When the Whole Space Shows Up: Adam Weitsman and Spencer Gordon-Sand at DDNYC 2026

Crypto ETF News: BTC, ETH, SOL Bleed as XRP ETF Survives the Crash

21Shares Analyst: Conditions for Bitcoin to Reach $100,000 in the Fourth Quarter Have Been Met!

Clarity Act adds new DeFi rules before Senate vote

XRP Healthcare Winds Down After $450K Wallet Thefts

Join our free newsletter for daily crypto updates!