Teollimi

Brevo (email platform used by Trezor, BitBox, CoinTracking) data breach

Was I affected?

Brevo (email platform used by Trezor, BitBox, CoinTracking) confirmed a breach affecting about 347,149 email addresses, exposing email addresses. You may be affected if you subscribed to newsletters from Trezor, BitBox, CoinTracking or another company that sends email through Brevo.

Brevo (email platform used by Trezor, BitBox, CoinTracking) breach facts
AnnouncedSep 9, 2026
When it happenedSeptember 9, 2026
CountrySeveral countries
Email addresses exposed347,149
Data exposedEmail addresses
StatusConfirmed by the company or a regulator filing

What happened

Paris-based email marketing platform Brevo said an attacker abused how it handled SAML single sign-on to get into 138 customer accounts, used six of them to send phishing emails and exported contact lists from 43. On September 9, 2026, phishing emails went out from the legitimate domains of crypto companies including hardware-wallet maker Trezor, BitBox and CoinTracking, urging users to act on fake security alerts. Trezor says its newsletter list of about 347,000 addresses received the email, about 2,500 people clicked the link before it was taken down, and Brevo later confirmed that 347,149 Trezor contacts were exported. Brevo held no passwords or wallet data, and Trezor says none of its own systems were touched.

What should I do?

  1. Never type a wallet recovery phrase into a website, app or form; if you entered it after a September 2026 email, move your funds to a new wallet immediately.
  2. Ignore 'security alert' or 'refresh your API keys' emails, even from a real company domain, and go to the official site or app yourself.
  3. If you used API keys with CoinTracking or similar services, rotate them from the official site.
  4. Expect more targeted crypto phishing at the same address; consider a separate email address for crypto services.
XRedditWhatsApp

Check the other services you use →

Sources