A critical authorization vulnerability in the login system of email marketing and customer relationship management platform Brevo has been exploited by an attacker to infiltrate 138 client accounts. The security breach enabled the unauthorized distribution of targeted phishing emails to approximately 347,000 subscribers of the hardware wallet manufacturer Trezor, alongside similar fraudulent communications sent through accounts belonging to competing hardware wallet maker BitBox and crypto portfolio tracking and tax-reporting platform CoinTracking. <\/p>\n
The incident, which came to light following warnings issued by affected crypto firms, highlights the cascading risks associated with third-party vendor security failures in the digital asset sector. Because the malicious emails were routed through legitimate enterprise accounts on Brevo, they successfully bypassed standard email authentication checks, including Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting, and Conformance (DMARC) protocols. To unsuspecting recipients, the messages appeared entirely authentic, bearing the legitimate domain infrastructure of trusted crypto service providers.<\/p>\n
In a detailed postmortem published on Thursday, Brevo outlined the mechanics of the exploit and the extent of the unauthorized access. The platform disclosed that the attacker deliberately created a rogue Brevo account, enabled single sign-on (SSO) configurations, and invited legitimate Brevo users into the malicious configuration. Under standard operational parameters, access should have been strictly confined to that specific organization. However, a catastrophic authorization boundary failure occurred, erroneously granting the attacker broad access to every external organization and client account that the invited users could reach. <\/p>\n
Brevo\u2019s investigation revealed that out of the 138 compromised accounts, six were actively weaponized to dispatch phishing emails to subscribers. Furthermore, contact lists were illicitly exported from 43 accounts, while 93 accounts showed no meaningful activity during the breach window. The platform did not specify whether these categories overlapped, leaving clients to independently audit their security postures and data exposure levels. Cointelegraph reached out to Brevo for additional information regarding the vulnerability patch and the exact timeline of the exploit, but did not receive a response prior to publication.<\/p>\n
The disclosure serves to clarify and expand upon urgent warnings initially raised by Trezor and BitBox. The sudden influx of malicious emails left both companies scrambling to alert their user bases, trace the vector of the attack, and coordinate emergency responses across international jurisdictions. As digital asset firms increasingly rely on centralized, third-party software-as-a-service (SaaS) providers for mass communication and marketing, the incident underscores the systemic vulnerabilities introduced by integrated enterprise software ecosystems.<\/p>\n
Following the initial security alerts, affected cryptocurrency companies initiated comprehensive internal reviews to assess the full scope of subscriber exposure and mitigate potential fallout. Trezor was among the first to detail the nature of the attack in an official blog post. The company revealed that the fraudulent email was dispatched under the alarming title \u201cCritical Security Alert: STM32 Entropy Vulnerability.\u201d The message contained a malicious link directing recipients to a deceptive application designed to harvest users’ critical wallet backups and recovery seed phrases.<\/p>\n
Swift action by Trezor\u2019s security team prevented widespread adoption of the phishing trap. The company successfully disabled the malicious domain at the Domain Name System (DNS) level within just 20 minutes of discovering the unauthorized broadcast. Nevertheless, telemetry data indicated that approximately 2,500 individuals had already accessed the fraudulent link before the rapid takedown took effect. <\/p>\n
A Trezor spokesperson provided further clarity to Cointelegraph, confirming that the initial email blast reached roughly 347,000 customers. All impacted individuals were subsequently contacted directly regarding the security risk and advised to remain vigilant against follow-up social engineering attempts. Crucially, Trezor emphasized that its compromised Brevo account stored exclusively opt-in newsletter email addresses and contained no other sensitive customer data, financial records, or private keys. <\/p>\n
Despite containing the breach quickly, the hardware wallet provider is adopting a worst-case scenario approach. Until further forensic data becomes available from Brevo, Trezor is treating all approximately 347,000 newsletter email addresses as fully known to the attacker and potentially subject to reuse in future phishing campaigns or targeted social engineering attacks. <\/p>\n
BitBox faced a similarly alarming situation when unauthorized actors hijacked its Brevo channel. A spokesperson for BitBox confirmed to Cointelegraph that the rogue email was distributed through their Brevo integration and appeared to have reached their entire subscriber list, which encompasses both newsletter recipients and tutorial followers. <\/p>\n
Much like Trezor, BitBox reported that its Brevo database held only basic subscriber details, specifically email addresses and designated language preferences. Preliminary internal audits found no evidence of compromised corporate credentials, unauthorized data downloads of deeper customer records, compromised user funds, or disclosed recovery phrases. However, out of an abundance of caution, BitBox is similarly treating the entire mailing list as potentially compromised while awaiting comprehensive server logs and definitive forensic reports from Brevo.<\/p>\n
Meanwhile, CoinTracking took to social media to alert its user base about the security breach. In a public statement published on the social media platform X, CoinTracking confirmed that its Brevo account had been leveraged to distribute an unauthorized email carrying the subject line \u201cData Breach Notice: Please refresh API Keys as soon as possible.\u201d The malicious message attempted to induce panic, prompting recipients to take immediate action through fraudulent channels. CoinTracking strongly warned its community members not to follow any links embedded within the email and cautioned users against sharing sensitive account credentials or refreshing API keys via unverified prompts.<\/p>\n
The incident continues to reverberate across the broader blockchain and cryptocurrency industry, prompting renewed scrutiny over vendor risk management, multi-factor authentication enforcement, and access control boundaries among third-party service providers. As digital asset organizations grapple with the fallout, affected platforms are urging users to exercise extreme caution when evaluating security alerts, software updates, or urgent calls to action delivered via electronic mail, regardless of whether the sender appears to be a trusted industry entity.<\/p>\n","protected":false},"excerpt":{"rendered":"
A critical authorization vulnerability in the login system of email marketing and customer relationship management platform Brevo has been exploited by an attacker to infiltrate 138 client accounts. The security breach enabled the unauthorized distribution of targeted phishing emails to approximately 347,000 subscribers of the hardware wallet manufacturer Trezor, alongside similar fraudulent communications sent through<\/p>\n","protected":false},"author":13,"featured_media":803,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[496],"tags":[871,302,867,684,870,503,4,399,385,433,184,868,5,869,263],"class_list":["post-804","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-wallet-security","tag-accounts","tag-across","tag-brevo","tag-campaigns","tag-client","tag-cold-storage","tag-crypto","tag-exposes","tag-flaw","tag-hardware","tag-phishing","tag-platforms","tag-security","tag-triggering","tag-wallets"],"_links":{"self":[{"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/posts\/804","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/users\/13"}],"replies":[{"embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=804"}],"version-history":[{"count":0,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/posts\/804\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/media\/803"}],"wp:attachment":[{"href":"https:\/\/wyominginvest.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=804"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=804"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=804"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}