# Brevo login flaw lets attacker email a fake Trezor 'STM32 entropy' alert to 347,000 subscribers

- Severity: Medium · Status: Contained (past)
- Chains: Bitcoin, Multiple EVM chains · Method: Social engineering and fake support
- Started: Sep 9, 2026 · Last update: Sep 11, 2026
- Who/what: Trezor, BitBox and CoinTracking newsletter subscribers

An attacker abused an authorization flaw in email platform Brevo to reach 138 client accounts and send phishing from six of them. One was a fake Trezor 'Critical Security Alert: STM32 Entropy Vulnerability' sent to about 347,000 Trezor newsletter subscribers, linking to an app that asked for wallet backups; BitBox's list and CoinTracking (a fake 'refresh API keys' email) were also used. Trezor took the phishing domain down within 20 minutes; about 2,500 people opened the link and no losses have been reported. Recipients should expect follow-up phishing to the same addresses.

## Am I affected?
If around 9 September 2026 you got a Trezor email about an 'STM32 entropy vulnerability', an unexpected BitBox email, or a CoinTracking email asking you to refresh API keys, and you entered your recovery phrase or wallet backup anywhere, your wallet is compromised.

## What to do now
- If you entered your seed: set up a new wallet with a new seed on a device you trust and move all funds now.
- If you only opened the email: delete it. Your address is now on a phishing list, so expect more.
- CoinTracking users: rotate exchange API keys from the exchange's own website.

## How to avoid this
- No wallet maker will ever ask for your recovery phrase or a wallet backup by email, app or website.
- Get firmware and security notices only through the vendor's own app (Trezor Suite, BitBoxApp) or a website you type in yourself.

## Sources
- Brevo login flaw enabled phishing email targeting 347K Trezor subscribers (Cointelegraph, 2026-09-11): https://cointelegraph.com/news/brevo-login-flaw-trezor-bitbox-cointracking-phishing

Full record: https://drains.watch/i/brevo-flaw-trezor-bitbox-phishing-emails-sep-2026 · JSON: https://drains.watch/i/brevo-flaw-trezor-bitbox-phishing-emails-sep-2026.json

Rules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support.