Bitbox
1 incident, 0 live. 43 days since the last new one.
1 drains in the last 12 months
1 drains in the last 12 months
1 drains in 2026
Past
September 2026 1
-
Medium✓Contained
Brevo login flaw lets attacker email a fake Trezor 'STM32 entropy' alert to 347,000 subscribers
An attacker abused an authorization flaw in email platform Brevo to reach 138 client accounts and send phishing from six of them. One was a fake Trezor 'Critical Security Alert: STM32 Entropy Vulnerability' sent to about 347,000 Trezor newsletter subscribers, linking to an app that asked for wallet backups; BitBox's list and CoinTracking (a fake 'refresh API keys' email) were also used. Trezor took the phishing domain down within 20 minutes; about 2,500 people opened the link and no losses have been reported. Recipients should expect follow-up phishing to the same addresses.
Trezor, BitBox and CoinTracking newsletter subscribers·Bitcoin, Multiple EVM chains·Since Sep 9, 2026·
No drains match these filters.