A critical authorization vulnerability in the login system of email marketing and customer relationship management platform Brevo has been exploited by an attacker, leading to unauthorized access to 138 client accounts. The security breach enabled threat actors to distribute convincing phishing emails to roughly 347,000 subscribers of hardware wallet manufacturer Trezor\u2019s newsletter, alongside similar fraudulent communications sent through accounts belonging to rival hardware wallet maker BitBox and crypto portfolio tracking and tax-reporting platform CoinTracking. <\/p>\n
The incident came to light following warnings issued by prominent crypto industry participants regarding suspicious emails that successfully bypassed standard authentication mechanisms, appearing entirely genuine to recipients. In a detailed postmortem published on Thursday, Brevo outlined the mechanics of the exploit and the scope of the compromise, shedding light on a critical system architecture failure that allowed the unauthorized access to propagate across multiple client organizations.<\/p>\n
According to Brevo\u2019s incident report, the attacker initiated the breach by creating a legitimate account on the platform, enabling single sign-on (SSO) capabilities, and subsequently inviting authorized Brevo users into the malicious configuration. Under normal operating parameters, access via such an invitation should have been strictly confined to the specific organization initiating the setup. However, a severe authorization boundary failure occurred within the platform\u2019s security controls, inadvertently granting the attacker access to every single organization and client account that the invited users could reach.<\/p>\n
Brevo\u2019s investigation revealed that the compromised accounts experienced varying degrees of unauthorized activity. Specifically, six of the breached accounts were actively utilized by the attacker to dispatch malicious phishing emails to subscribers. Furthermore, contact lists were exported from 43 accounts, while 93 accounts showed no meaningful activity during the window of exposure. The platform\u2019s initial public disclosures did not specify whether there was an overlap between these different categories of affected accounts, leaving clients to conduct their own independent forensic assessments.<\/p>\n
The disclosure provides crucial context to warnings initially raised by Trezor and BitBox earlier in the week. Those preliminary advisories alerted the crypto community to sophisticated phishing campaigns making the rounds, explaining why the fraudulent emails were able to clear standard authentication checks like SPF, DKIM, and DMARC to land directly in primary inboxes. Cointelegraph reached out to Brevo for additional comment and clarification following the incident, but did not receive a response prior to publication.<\/p>\n
In the wake of the breach, affected cryptocurrency companies scrambled to notify their user bases, assess the extent of the data exposure, and implement defensive countermeasures. Trezor published a comprehensive blog post detailing the security incident involving its third-party email service provider, confirming that the fraudulent message distributed through its account carried the alarming title, \u201cCritical Security Alert: STM32 Entropy Vulnerability.\u201d <\/p>\n
The malicious email contained a prominent link directing recipients to a rogue application designed to prompt users into revealing their sensitive wallet backups and recovery phrases. Swift action by Trezor\u2019s security team helped mitigate the immediate fallout; the company successfully disabled the malicious destination domain at the Domain Name System (DNS) level within just 20 minutes of discovering the attack. Despite this rapid response, approximately 2,500 individuals had already accessed the link before the domain was rendered inactive.<\/p>\n
A Trezor spokesperson provided additional details to Cointelegraph, confirming that the initial phishing email was successfully dispatched to 347,000 customers. All impacted subscribers were subsequently contacted by the company and warned about the specific risks associated with the breach. Trezor emphasized that its integrated Brevo account was utilized strictly for managing opt-in newsletter email addresses and contained no other sensitive customer data, financial records, or private keys. <\/p>\n
Nevertheless, out of an abundance of caution, the hardware wallet manufacturer is operating under the assumption that the entire subscriber base has been compromised. "Until we hear more from Brevo, we are treating all roughly 347,000 newsletter addresses as known to the attacker and possibly reusable for phishing," the spokesperson stated, urging users to remain highly vigilant against future fraudulent outreach.<\/p>\n
Similarly, a spokesperson for BitBox informed Cointelegraph that the unauthorized email distributed through its Brevo-managed infrastructure appeared to have reached its entire distribution list, which encompassed subscribers to both its official newsletter and educational tutorial series. BitBox confirmed that its integration with Brevo stored only basic contact information, consisting exclusively of email addresses and preferred language settings. <\/p>\n
An initial internal review by BitBox found no evidence that company credentials had been compromised, nor did it find indications that contacts had been downloaded in bulk, that user funds had been lost, or that recovery phrases had been exposed. However, much like its industry peers, BitBox is currently treating its entire mailing list as potentially accessed by unauthorized parties while it awaits comprehensive logs and final forensic reports from Brevo.<\/p>\n
Meanwhile, crypto portfolio tracking and tax-reporting platform CoinTracking addressed the security incident through a public statement on social media platform X, confirming that its Brevo account had been hijacked to distribute a fraudulent email carrying the subject line, "Data Breach Notice: Please refresh API Keys as soon as possible." CoinTracking strongly warned its user base not to interact with the email or follow any of the embedded links, as the communications were entirely unauthorized and designed to harvest sensitive user credentials or account access permissions.<\/p>\n","protected":false},"excerpt":{"rendered":"
A critical authorization vulnerability in the login system of email marketing and customer relationship management…<\/p>\n","protected":false},"author":26,"featured_media":798,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[496],"tags":[857,860,855,445,856,861,503,399,385,433,184,5,858,814,859,256,263],"class_list":["post-799","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-wallet-security","tag-accounts","tag-bitbox","tag-brevo","tag-campaign","tag-client","tag-cointracking","tag-cold-storage","tag-exposes","tag-flaw","tag-hardware","tag-phishing","tag-security","tag-sparking","tag-targeting","tag-trezor","tag-users","tag-wallets"],"_links":{"self":[{"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/posts\/799","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/users\/26"}],"replies":[{"embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=799"}],"version-history":[{"count":0,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/posts\/799\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=\/wp\/v2\/media\/798"}],"wp:attachment":[{"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=799"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=799"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/smartcryptosecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=799"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}