Brevo, the email marketing platform formerly known as Sendinblue, has published the root-cause account of the breach that turned its own infrastructure into a delivery channel for crypto-phishing emails. The company says an authorization flaw in its login system let an attacker reach 138 customer accounts, and that Trezor, BitBox, and CoinTracking were among the businesses whose subscriber lists got swept up in the resulting campaign. The scoping bug, not a stolen password or a brute-forced login, is what let messages go out from real company domains to real subscribers, which is why the “Critical Security Alert: STM32 Entropy Vulnerability” email fooled so many people who would normally know better.
Trezor first disclosed on September 9-10, 2026 that its Brevo account had been compromised, putting roughly 347,000 newsletter subscribers at risk of follow-on phishing. What’s changed since then is the picture of how the breach actually happened, how far it spread beyond Trezor, and what it says about the SaaS vendors that sit quietly behind almost every crypto company’s marketing stack. Brevo says unauthorized access was fully closed at 11:30 AM CEST on September 10, 2026, according to TechCrunch. But the fallout, and the questions about vendor risk it raises, are only starting.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What Brevo Says Actually Went Wrong
Brevo’s post-incident explanation, as reported by Cointelegraph, points to a flaw in the platform’s single sign-on and login authorization system. Access that should have been scoped to a single account was, in effect, not properly scoped and got wrongly granted to organizations reachable through that account. The mechanics described suggest the attacker invited legitimate Brevo users into an attacker-controlled account, then rode that connection into the organizations those users could reach. It’s a lateral-movement problem dressed up as an email breach: the entry point wasn’t a phishing email sent to Brevo employees or a leaked credential, it was a permission boundary that didn’t hold.
That distinction matters for how the industry should respond. A leaked password gets fixed with a reset and multi-factor authentication. A scoping flaw in an SSO system means every downstream customer, no matter how strong their own login was, had zero visibility into the exposure until Brevo told them. TechCrunch reported that hackers were able to access 138 Brevo accounts to send out the mass volume of phishing messages, which is the detail that turns this from a single-company incident into a supply-chain story.
The Numbers Behind the 138 Accounts
Not every compromised account was used the same way, and the breakdown is worth sitting with because it shows how much restraint, or how much opportunity, the attacker actually had. Of the 138 Brevo customer accounts the attacker could reach, only 6 were used to send phishing emails. A larger group, 43 accounts, had their contact lists exported without any phishing email going out from them yet, meaning those address books may resurface in future campaigns that have nothing to do with the original Trezor lure. The remaining 93 accounts showed no meaningful activity from the attacker at all, according to the figures Brevo disclosed and that outlets including Cointelegraph relayed.
That 43-account figure is arguably the more important number for anyone not named Trezor, BitBox, or CoinTracking. It means the total blast radius of this breach isn’t limited to the three crypto firms that have been named publicly. Brevo has not disclosed the identities of the other 40 businesses whose contact data was exported, and there’s no indication yet that all of them have been notified in a way that’s become public.
| Account Category | Count | Attacker Action | Disclosed Publicly |
|---|---|---|---|
| Phishing emails sent | 6 | Sent mass phishing campaigns to subscriber lists | Yes — Trezor, BitBox, CoinTracking named |
| Contacts exported only | 43 | Address books copied, no phishing sent yet | No — companies not named |
| No meaningful activity | 93 | Access existed but wasn’t exploited | No — companies not named |
| Total accounts affected | 138 | — | Partial |
Three Named Crypto Companies, One Shared Vendor
Trezor is the name most people recognize, but it wasn’t alone. BitBox, the hardware wallet made by Swiss company Shift Crypto, and CoinTracking, a portfolio and tax-reporting platform used by crypto traders to reconcile transactions for filing purposes, were also caught in the same Brevo compromise. CoinTracking posted a public warning on X acknowledging the incident, saying the company was “currently investigating the incident and will provide further information as soon as it becomes available”.
The three companies don’t compete with each other in any meaningful sense, which is exactly the point. What they share isn’t a market or a product category, it’s a marketing vendor. That’s the pattern security teams have been warning about for years and that keeps playing out anyway: crypto companies invest heavily in securing wallets, seed generation, and on-chain infrastructure, then hand their customer email lists to a third-party SaaS platform with a much smaller security budget and a much bigger attack surface, since that same platform serves thousands of other customers across every industry.
Anatomy of the Phishing Lure
The email itself was built to sound like exactly the kind of alert a security-conscious hardware wallet owner would take seriously. Subject line: “Critical Security Alert: STM32 Entropy Vulnerability.” The body claimed a factory defect caused roughly one in four Trezor devices to generate weak cryptographic seeds, and urged recipients to check whether their own device was affected. STM32 is a real family of microcontrollers used in hardware security products, which gave the claim a technical veneer that a generic “your account has been compromised” email wouldn’t have had.
Recipients who clicked through were pushed toward an application download that then asked for their wallet backup password or seed phrase, the two pieces of information that, if handed over, give an attacker full control of a crypto wallet. There’s no device exploit involved anywhere in this chain. The entire attack is social engineering, and it depended entirely on the email looking legitimate enough to bypass the skepticism that crypto users are, in theory, trained to have.
Why the Legitimate Sending Domain Mattered
What made this campaign more dangerous than an ordinary spoofed email is that it wasn’t spoofed at all. Reports indicate the phishing messages went out through Trezor’s actual mailing infrastructure, including a tracking subdomain associated with Trezor’s newsletter system, sent via Brevo using Trezor’s real sending domain rather than a look-alike. Any recipient checking the sender address, hovering over the “from” field, or glancing at SPF and DKIM authentication headers would have seen a pass, because technically, the mail was authenticated. It came from Trezor’s own DNS records pointing at Brevo’s mail servers, exactly as legitimate newsletters do every day.
Example authentication result on a legitimate-looking but attacker-triggered send:
SPF: PASS (domain aligns with sender's registered mail provider)
DKIM: PASS (signed with the domain's own private key)
DMARC: PASS (policy satisfied because SPF/DKIM aligned)
Result: Standard email filters see a fully authenticated message.
The compromise sits upstream of DNS-level checks, inside the
marketing platform's account-permission layer, not in the
headers a spam filter or a cautious user would normally inspect.That’s the uncomfortable lesson for anyone relying on email authentication as a phishing defense: SPF, DKIM, and DMARC verify that a message came from an authorized sending platform. They don’t verify that the account sending it wasn’t hijacked through a permissions bug on that platform. Trezor’s mailing domain passed every technical check a recipient’s email client could run, because the flaw lived one layer up, inside Brevo’s account authorization logic.
The Containment Timeline
Trezor’s response, once the phishing emails started landing, moved fast by breach-response standards. The company disabled the compromised mailing subdomain at the DNS level within roughly 20 minutes of detecting the campaign, according to figures cited in crypto-industry coverage. By that point, an estimated 2,500 users had already clicked the phishing links, a number that illustrates both how quickly a mass-send campaign can spread and how a 20-minute response window still isn’t fast enough to catch everyone once a convincing email starts hitting inboxes.
Trezor also suspended its Brevo account entirely, took down the phishing application’s landing domain, and opened an internal investigation into how the attacker obtained the level of access it did. On social media, Trezor told users directly: “Our third-party e-mail provider has been breached. Please be aware that the email named ‘Critical Security Alert: STM32 Entropy Vulnerability’ is not coming from us, and it’s a phishing attempt. Do not click on any link.” The company added that it was investigating the situation, including how the attacker got access to its legitimate domain, a distinction that separates this incident cleanly from any compromise of Trezor’s own wallet firmware or device supply chain.
Trezor has been explicit that Brevo’s system held nothing beyond newsletter email addresses. According to the company’s own incident blog, Brevo’s system holds no passwords, wallet data, or other personal information, and no Trezor product, wallet, or account system was affected. Even so, Trezor is treating the roughly 347,000 exposed addresses as fully known to the attacker and reusable for future phishing attempts indefinitely, since an email address, unlike a password, can’t be rotated or reset.
Historical Context: This Isn’t Crypto’s First Marketing-Vendor Breach
Hardware wallet buyers have been through a version of this before. Ledger, Trezor’s closest competitor, disclosed a breach in 2020 that exposed roughly 1.1 million email addresses and 272,000 records containing full names, phone numbers, and home addresses, pulled from its e-commerce and marketing systems rather than its wallet infrastructure. That data was later dumped publicly online, and Ledger customers spent months, in some cases years, fielding targeted phishing attempts and even physical threats tied to the leaked address data. Ledger notified French authorities and filed a complaint with the public prosecutor’s office at the time.
The Brevo incident and the 2020 Ledger breach are unrelated technically, different companies, different vendors, different attack vectors. But the shape of the story is identical: a hardware wallet maker’s core security holds, while a third-party marketing or e-commerce system becomes the point of failure. Six years apart, the two biggest names in hardware wallets have each had customer contact data exposed not because their devices were broken into, but because the systems they used to email customers weren’t held to the same security bar.
| Incident | Year | Vendor Compromised | Records Exposed | Core Wallet Affected? |
|---|---|---|---|---|
| Ledger marketing breach | 2020 | E-commerce/CRM system | ~1.1M emails, 272K full records (names, phones, addresses) | No |
| Trezor/Brevo breach | 2026 | Brevo (email marketing SaaS) | ~347,000 newsletter emails | No |
| BitBox/Brevo breach | 2026 | Brevo (shared account) | Undisclosed subscriber count | No |
| CoinTracking/Brevo breach | 2026 | Brevo (shared account) | Undisclosed subscriber count | No |
The pattern extends well beyond hardware wallets, too. Crypto exchanges, custody providers, and portfolio trackers have all had customer data exposed through support-desk platforms, CRM tools, and marketing software rather than through their actual financial infrastructure. The Liquid Network hack earlier this year and the XRPL wallet breach both drew attention to direct protocol-level theft, but the Brevo incident is a reminder that the softer, less glamorous parts of a crypto company’s stack, the newsletter tool, the support ticketing system, the CRM, are where attackers increasingly find it easiest to get in.
Why This Keeps Happening: The Vendor Risk Blind Spot
Security teams at crypto companies tend to pour resources into the things that would make headlines if broken: hardware security modules, seed generation entropy, multi-signature custody, smart contract audits. Vendor risk management for a newsletter tool rarely gets the same scrutiny, because on paper it looks low-stakes. An email marketing platform doesn’t touch private keys. It doesn’t sign transactions. It just sends newsletters.
But an email platform with access to a verified sending domain and a list of everyone who has ever opted into a company’s mailing list is, in practice, a trust amplifier. It can send messages that inherit all the credibility of the brand behind them, to an audience that has self-selected as people who care enough about that brand to subscribe in the first place. For a hardware wallet company, that audience is disproportionately made up of people who own meaningful amounts of cryptocurrency, which makes the newsletter list itself a higher-value target than the subscriber count alone would suggest.
The UK’s National Cyber Security Centre has long recommended that organizations treat marketing and communication platforms with the same access-review rigor as financial systems, precisely because compromising one lets an attacker borrow the trust of every brand that uses it. That guidance tends to get read as boilerplate advice until an incident like this one shows exactly how it plays out.
Market and Industry Impact
The immediate financial impact on Trezor, BitBox, or CoinTracking hasn’t been quantified in public disclosures, and none of the three are publicly traded companies with a stock price to move. The real cost of an incident like this shows up more slowly, in support ticket volume, in customer trust, and in how many of the roughly 347,000 exposed Trezor subscribers unsubscribe from future communications or start second-guessing genuine security alerts down the road. That last effect, sometimes called alert fatigue, is a real risk: once a company’s own legitimate warning emails get mixed up in public memory with a phishing campaign, future real alerts may get ignored too.
For Brevo, the reputational exposure is more direct. The platform competes with Mailchimp, HubSpot, Klaviyo, and other marketing automation tools for enterprise and SMB customers, and an authorization flaw serious enough to let one attacker reach 138 accounts, some belonging to security-conscious crypto companies, is the kind of incident that shows up in vendor security questionnaires for years. Enterprise procurement teams doing due diligence on email marketing platforms now have a concrete, recent example to ask about.
There’s also a knock-on effect for the broader identity and access management market. Vendors selling SSO auditing tools, permission-scoping software, and zero-trust access platforms have an easy case study to point to when pitching crypto and fintech clients on tighter controls over which third-party accounts can reach which customer data. That case for tighter access controls has been building all year, from the Veradigm breach to broader industry data showing breach costs climbing across the board, and vendor-side permission flaws are increasingly the common thread.
How Hardware Wallet Vendors Compare on Vendor Risk
Trezor and Ledger remain the two dominant hardware wallet brands by market presence, with BitBox occupying a smaller but security-focused niche, particularly popular in Europe. None of the three has published a detailed public framework for how they vet or monitor third-party SaaS vendors that touch customer contact data, which makes it hard to say definitively whether one handles vendor risk better than another. What’s observable is response behavior once an incident happens: Trezor’s DNS-level takedown within roughly 20 minutes and its direct, plain-language social media warning are the kind of fast, transparent response security researchers generally credit companies for, even when the underlying vulnerability sat with a third party outside their direct control.
The open question, for Trezor, BitBox, CoinTracking, and every other company that uses Brevo or a comparable platform, is whether this incident triggers a broader move toward self-hosted or more tightly audited email infrastructure for security-sensitive communications, or whether the industry treats it as a one-off vendor failure and continues business as usual once the immediate phishing wave dies down.
What Crypto Owners Should Do Right Now
Anyone who has ever subscribed to a Trezor, BitBox, or CoinTracking newsletter should assume their email address is now circulating among people running phishing campaigns, regardless of whether they received the “STM32 Entropy Vulnerability” email specifically. The most important single rule holds regardless of how convincing an email looks: no legitimate hardware wallet company will ever ask for a seed phrase, recovery phrase, or wallet backup password by email, through a downloaded app, or over a phone call. Seed phrases are meant to stay offline, written down, never typed into a website or app prompted by an unsolicited message.
Users can check whether an email address has appeared in known breach datasets using free tools like Have I Been Pwned, though absence from that database doesn’t guarantee an address wasn’t part of this specific incident, since Brevo and Trezor’s disclosures haven’t been published as a searchable breach file. The more durable habit is treating any unsolicited “urgent security alert” as suspicious by default, verifying claims directly through a company’s official app or website rather than clicking email links, and enabling a password manager that won’t autofill credentials on a look-alike phishing page.
What Comes Next: Five Predictions
Based on how similar SaaS-vendor breaches have played out historically and the details Brevo and Trezor have disclosed so far, here’s how this incident is likely to develop over the coming months.
- Expect Brevo to face pressure to disclose the identities of the other roughly 40 companies whose contact lists were exported but not yet weaponized, either voluntarily or through regulatory inquiry, since those businesses’ customers remain at risk without knowing it.
- More phishing waves tied to the exported-but-unused contact lists are likely in the weeks ahead, potentially using different lures than the STM32 pretext once that specific angle becomes widely recognized and filtered.
- Hardware wallet and crypto-adjacent companies will accelerate audits of their own third-party marketing and CRM vendors, mirroring the vendor-risk reviews that followed Ledger’s 2020 breach.
- Email authentication alone, meaning SPF, DKIM, and DMARC, will get renewed scrutiny as an insufficient phishing defense, pushing more security-conscious companies toward in-app notifications for anything security-critical rather than email.
- Regulatory attention, if it materializes, is more likely to focus on Brevo’s account-permission architecture as a platform-level failure than on any individual customer company, given that the flaw sat entirely within Brevo’s own systems.
The Bigger Picture
Nothing about the Brevo breach touched a Trezor device, a BitBox device, or the underlying cryptography either company relies on to protect private keys. That’s worth repeating, because it’s the detail most likely to get lost as headlines about hundreds of thousands of crypto owners being targeted circulate. The actual failure sits in a permissions system at a third-party marketing platform, a category of software that rarely gets the security attention it arguably deserves given how much brand trust it’s able to borrow once compromised.
That’s simultaneously reassuring and unsettling. Reassuring, because the wallets themselves, the actual custody of crypto assets, remain secure by every account given so far. Unsettling, because it means the weakest link in a security-first industry keeps turning out to be the same mundane software every other industry also uses without a second thought: the newsletter tool. Until crypto companies start treating marketing platforms with the same scrutiny as custody infrastructure, incidents like this one, alongside the steady drumbeat of cybersecurity threats tracked across the industry this year, are more likely to repeat than fade.
Frequently Asked Questions
What actually caused the Brevo breach?
Brevo has attributed the incident to a flaw in its login and single sign-on authorization system, which allowed an attacker to reach 138 customer accounts by exploiting improperly scoped access permissions, not a stolen password or brute-force attack.
Were Trezor devices or wallets compromised?
No. Trezor has stated explicitly that no Trezor product, wallet, or account system was affected. Only newsletter email addresses stored in its Brevo account were exposed.
Which companies besides Trezor were affected by the Brevo breach?
BitBox, the hardware wallet made by Shift Crypto, and CoinTracking, a crypto portfolio and tax platform, have both been named as affected by the same Brevo compromise. Brevo has not publicly named the other companies among the 138 total affected accounts.
What was the phishing email about?
The email, titled “Critical Security Alert: STM32 Entropy Vulnerability,” falsely claimed a factory defect caused roughly one in four Trezor devices to generate weak cryptographic seeds, and directed recipients to download an app that then requested their wallet backup password or seed phrase.
How many people were affected?
Trezor is treating roughly 347,000 newsletter subscribers as exposed. Brevo separately disclosed that 43 additional customer accounts had contact lists exported without a phishing campaign following yet, meaning the total number of individuals whose data was touched, across all 138 accounts, is likely higher and has not been fully disclosed.
How did Trezor respond?
Trezor disabled the compromised mailing subdomain at the DNS level within roughly 20 minutes of detecting the campaign, suspended its Brevo account, took down the phishing application’s landing domain, and issued public warnings via its official blog and social media accounts.
Should I stop using my hardware wallet if I got the phishing email?
No. The hardware wallet itself was never part of the breach. The correct response is to delete the phishing email without clicking any links, never enter a seed phrase into any app or website prompted by an email, and verify any security claim directly through the official Trezor app or website.
Is this connected to the 2020 Ledger data breach?
Not directly. The two incidents involve different companies and different vendors. Ledger’s 2020 breach exposed roughly 1.1 million email addresses and 272,000 full records through its own e-commerce and marketing systems, while the 2026 incident stems from a shared third-party platform, Brevo, used by Trezor, BitBox, and CoinTracking. The pattern, a marketing or CRM system becoming the point of failure rather than core wallet infrastructure, is similar in both cases.
