Vendor

BitBox

2 mentions in 7 days · 2 in 30 days · 2 total · first seen Sep 10, 2026 · last 4d ago

Timeline2 articles

Trezor Says 347,000 Users Received Phishing Emails After Brevo Hack

Attackers abused Brevo's SAML SSO to access 138 accounts, sending phishing emails to 347,000 Trezor customers and exfiltrating contacts from 43 accounts.

Trezor said 347,000 of its customers received phishing emails with the subject line 'Critical Security Alert: STM32 Entropy Vulnerability' after the attacker compromised the Brevo marketing platform. Brevo said the intruder created an account, enabled SAML SSO, and used its own identity provider to access 138 accounts, exfiltrating contacts from 43 of them. Trezor reported 2,500 users clicked the malicious link before the site was taken offline 20 minutes after detection; potential fund losses are unknown. Swiss wallet maker BitBox and crypto tax calculator CoinTracking also appear affected, and Trezor separately disclosed a ShipMonk breach now affecting roughly 81,000 people.

SecurityWeekupdated Sep 11, 15:01 UTC · 4d agofirst Sep 11, 12:48 UTC · 4d agoData breach in the wild 6 sources

Multiple crypto companies warn customers of phishing emails after alleged provider breach

Attackers compromised 120 Brevo email accounts and sent convincing phishing emails to Trezor, BitBox, and CoinTracking newsletter subscribers.

Trezor, BitBox, and CoinTracking confirmed that phishing emails were sent to newsletter subscribers after a compromise of their shared email provider, which CoinTracking identified as Brevo. Brevo said an attacker accessed 120 customer accounts and used them to send phishing emails from legitimate company domains, including fake security alerts like 'Critical Security Alert: STM32 Entropy Vulnerability' and 'Data Breach Notice: Please refresh API Keys.' Trezor had already suffered a separate breach exposing details of 81,000 customers, and CertiK reports physical wrench attacks on crypto holders rose 33 percent year-over-year with $124 million in losses in 2026.

The Recordupdated Sep 11, 15:01 UTC · 4d agofirst Sep 10, 04:00 UTC · 5d agoData breach 6 sources

Appears with

vendor CoinTracking 2 vendor Brevo 2 vendor Trezor 2 organization CoinTracking 1 organization Trezor 1 vendor CertiK 1 vendor ShipMonk 1 victim BitBox 1 victim CoinTracking 1 organization BitBox 1 victim Trezor 1 organization Brevo 1 organization CertiK 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.