Brevo login flaw lets attacker email a fake Trezor 'STM32 entropy' alert to 347,000 subscribers
Trezor, BitBox and CoinTracking newsletter subscribers
An attacker abused an authorization flaw in email platform Brevo to reach 138 client accounts and send phishing from six of them. One was a fake Trezor 'Critical Security Alert: STM32 Entropy Vulnerability' sent to about 347,000 Trezor newsletter subscribers, linking to an app that asked for wallet backups; BitBox's list and CoinTracking (a fake 'refresh API keys' email) were also used. Trezor took the phishing domain down within 20 minutes; about 2,500 people opened the link and no losses have been reported. Recipients should expect follow-up phishing to the same addresses.
Why this severity: A narrower target.
- Started
- Sep 9, 2026
- Closed
- Sep 11, 2026
- Chains
- Bitcoin, Multiple EVM chains
At risk
- Trezor, BitBox and CoinTracking newsletter subscribers
- Bitcoin wallets
- Multiple EVM chains wallets
What to do now
- If you entered your seed: set up a new wallet with a new seed on a device you trust and move all funds now.
- If you only opened the email: delete it. Your address is now on a phishing list, so expect more.
- CoinTracking users: rotate exchange API keys from the exchange's own website.
Stay safe
Am I affected?
If around 9 September 2026 you got a Trezor email about an 'STM32 entropy vulnerability', an unexpected BitBox email, or a CoinTracking email asking you to refresh API keys, and you entered your recovery phrase or wallet backup anywhere, your wallet is compromised.
What to do now
- If you entered your seed: set up a new wallet with a new seed on a device you trust and move all funds now.
- If you only opened the email: delete it. Your address is now on a phishing list, so expect more.
- CoinTracking users: rotate exchange API keys from the exchange's own website.
How to avoid this
- No wallet maker will ever ask for your recovery phrase or a wallet backup by email, app or website.
- Get firmware and security notices only through the vendor's own app (Trezor Suite, BitBoxApp) or a website you type in yourself.
Timeline 3
Cointelegraph reported about 2,500 people opened the Trezor phishing link before it was taken down, with no losses reported.
SourceBrevo's postmortem said 138 client accounts were accessed, six used to send phishing and contacts exported from 43.
SourceTrezor and BitBox warned users about unauthorized emails sent through their Brevo accounts.
Source
News & write-ups ›1
How this method works
Someone posing as support, a recruiter, a journalist or a friend talks you into revealing a seed phrase, installing malware or signing something. Read about social engineering and fake support →
Follow new drains and updates in your feed reader or Telegram RSS bot.