Attackers phished Trezor, BitBox and CoinTracking customers through one shared newsletter provider
Brevo says an intruder reached 120 customer accounts and used them to mail phishing from those customers' own domains. Three crypto companies confirmed their newsletter lists were hit. Only one named the provider.
The Watch · Security desk
What happened
- Thousands of cryptocurrency holders were inundated with phishing emails on Wednesday after attackers breached an email provider and sent messages through it.
- CoinTracking named Brevo as the source of the phishing, while Trezor and BitBox confirmed a third-party email provider was breached without naming which one.
- Recipients said the mail looked legitimate, and several clicked through to phishing sites that were nearly identical to the real platforms.
Why it matters
- What it limits constraint The one check subscribers are trained to run, look at the sender domain, cannot separate this campaign from real mail, because the provider sends on the brand's own domain.
- Who has to decide decision None of the three companies can tell subscribers whether their contact data was copied as well as mailed until Brevo publishes the post mortem it has promised.
- What it sets up precedent Prosecutors have already described stolen customer lists being used to rank crypto targets, and a newsletter provider now sits inside that supply chain.
Next story · Invest · 3d ago
Trezor will end some reseller authorizations on January 1, 2027 to focus on partners it can vet closelyConfirmed7 publishers
Brevo has not said how the accounts were opened. Its Thursday morning notice describes what happened after. "The bad actor used the access to send phishing emails to the client's contactbase. The access has been closed," the company said, with a full post mortem promised for a later date [4][5]. Brevo did not respond to requests for comment [4].
Three companies have confirmed their subscribers were mailed [2]. Brevo put the number of accessed accounts at 120 [4]. That leaves 117 accounts with no brand publicly attached to them, and no notice for those subscribers to read [13]. Brevo was founded in Paris in 2012 as an email marketing firm and raised more than $580 million in December to expand into the wider customer relationship management business [14].
Only CoinTracking named the provider. Trezor and BitBox pointed at a third-party email provider without naming it, and BitBox said the other targeted crypto companies "all share the same newsletter provider" [21][3].
The messages went out on the companies' legitimate domains and claimed to concern security issues needing customer action [6]. An email service provider sends on its customer's behalf, so the sender domain a subscriber would check was the real one. Recipients said they were alarmed at how legitimate the mail looked, and several clicked before landing on phishing sites nearly identical to the real platforms [7].
The lures were written per brand. Trezor subscribers received an email titled "Critical Security Alert: STM32 Entropy Vulnerability" that urged them to click a link and take specific actions [8]. CoinTracking's was titled "Data Breach Notice: Please refresh API Keys as soon as possible" and carried a malicious link [12]. Each asks for the action the real company would ask for after a real incident.
Trezor said its third-party email provider was breached and that the mail did not come from it [10]. "Do not click on any link. We have taken down the domain, and we are investigating the situation, including how the hackers got access to our legit domain," the company said [9]. BitBox sent a phishing warning to all its newsletter subscribers, contacted the provider and reported the phishing domains [15]. "Most of the phishing links appear to have been taken down already. We are still actively investigating this situation and will update you once we know more," BitBox said [16].
This is the second time in short order that Trezor customers have been reachable through a supplier. A different breach exposed the personal details of 81,000 customers [11], and after that incident, which involved its shipping and logistics provider, customers reported receiving malicious QR codes by postal mail [18]. During a cryptocurrency theft ring takedown, DOJ prosecutors said the criminals ranked targets using lists of cryptocurrency owners stolen from cryptocurrency companies [17]. CertiK counts wrench attacks up 33 percent year over year, with losses of $124 million so far this year against $10.5 million reported in the first half of 2025 [19]. Those two loss figures cover periods of different length [20].
What to watch
- Brevo's promised post mortem: the initial access route, and whether contact data was exported from any of the 120 accounts rather than only mailed.
- Whether other brands among the 120 accessed accounts publish notices, or the confirmed victim list stays at three.
- Whether the phishing domains Trezor and BitBox reported taken down reappear on new hosting.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence68
- Adoption
- Not scored
- Hype gap−20
- Incentives40
- Confidence70
Perspective Coverage
4 publishers- Builder
- Builder 15%
- Operator
- Operator 69%
- Investor
- Investor 16%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Thousands of cryptocurrency holders were inundated with phishing emails on Wednesday after hackers breached an email provider and sent out corrupted messages.
- [2]
Trezor, CoinTracking and BitBox confirmed that phishing emails were sent out to customers subscribed to their newsletters.
- [3]
BitBox noted that multiple other crypto companies targeted "all share the same newsletter provider."
- [4]
Brevo did not respond to requests for comment but released its own notice on Thursday morning warning that an attacker had access to 120 customer accounts.
- [5]
"The bad actor used the access to send phishing emails to the client's contactbase. The access has been closed," Brevo said, pledging to post a full post mortem at a later date.
- [6]
Each of the emails sent out used the legitimate company domains and purported to be focused on security issues requiring customer action.
- [7]
People who received the emails said they were alarmed at how legitimate they looked, and several clicked on the links before being taken to phishing websites that were nearly identical to the legitimate platforms.
- [8]
Trezor customers received an email titled "Critical Security Alert: STM32 Entropy Vulnerability" that urged them to click a link and take specific actions to address alleged security issues.
- [9]
"Do not click on any link. We have taken down the domain, and we are investigating the situation, including how the hackers got access to our legit domain," Trezor said.
- [10]
Trezor, a hardware wallet manufacturer, released a message on social media saying their third-party email provider was breached and that the email did not come from them.
- [11]
Trezor recently suffered a different breach exposing the personal details of 81,000 customers, and also posted a notice on its website about the fake email.
- [12]
CoinTracking said hackers sent an email titled "Data Breach Notice: Please refresh API Keys as soon as possible" to its customers that contained a malicious link.
- [13]
Of the 120 Brevo customer accounts the attacker accessed, 117 have not been publicly attached to a named brand, because only three companies (Trezor, CoinTracking, BitBox) have confirmed their newsletter lists were mailed.
- [14]
Brevo was founded in Paris as an email marketing firm in 2012, and raised more than $580 million in December to help expand to other parts of the customer relationship management business.
- [15]
BitBox explained that it sent a phishing warning to all its newsletter subscribers, contacted the provider and reported the phishing domains.
- [16]
"Most of the phishing links appear to have been taken down already. We are still actively investigating this situation and will update you once we know more," BitBox said.
- [17]
During the takedown of a noted cryptocurrency theft ring, DOJ prosecutors noted that the criminals ranked targets using lists of cryptocurrency owners stolen from cryptocurrency companies.
- [18]
After Trezor's recent data breach involving its shipping and logistics provider, customers of the company reported getting malicious QR codes by postal mail.
- [19]
The number of wrench attacks grew 33 percent year-over-year, according to blockchain security audit company CertiK, with losses reaching $124 million so far this year compared with $10.5 million reported in the first half of 2025.
- [20]
CertiK's two wrench-attack loss figures are not on the same basis: $124 million covers the year so far, while $10.5 million covers only the first half of 2025.
- [21]
Trezor and BitBox did not confirm which email provider was breached, but CoinTracking said email service provider Brevo was the source of the phishing emails.
Sources
4 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comTrezor warns users of email provider breach, phishing attacks
2 articles · September 11, 2026
- malwarebytes.comCrypto customers targeted by scammers after email marketing provider breach
1 article · September 11, 2026
- securityweek.comTrezor Says 347,000 Users Received Phishing Emails After Brevo Hack
1 article · September 11, 2026
- therecord.mediaMultiple crypto companies warn customers of phishing emails after alleged provider breach
1 article · September 9, 2026
Topics and entities
Topics
- Wrench attacks
- Cryptocurrency security
- Phishing
- Single Sign-On
- Software supply chain attacks