Trezor, BitBox, and CoinTracking Users Hit by Phishing Campaign After Brevo Email Provider Breach: Full Technical Analysis

What happened: a coordinated phishing attack on hardware wallet users

Attackers exploited a breach at Brevo, the email marketing and newsletter platform formerly known as Sendinblue, to send fraudulent “Critical Security Alert” emails directly to the subscriber lists of Trezor, BitBox, and CoinTracking. The emails impersonated legitimate security bulletins, warned recipients of a fabricated “STM32 Entropy Vulnerability,” and pointed them to a fake verification tool built to harvest wallet recovery phrases.

What makes the attack notable is that the phishing emails came from the companies’ own legitimate sending infrastructure. This wasn’t spoofed headers or a lookalike domain thrown together in a hurry. The attackers had access to the actual email delivery pipeline these companies use to reach their users, so the messages carried valid SPF, DKIM, and DMARC records. To both email clients and end users, they looked identical to genuine communications from Trezor, BitBox, or CoinTracking.

Trezor confirmed the breach directly: “Our third-party email provider has been breached. Please be aware that the email named ‘Critical Security Alert: STM32 Entropy Vulnerability’ is not coming from us, and it’s a phishing attempt. Do not click on any link.” BitBox followed with its own disclosure, saying its preliminary review pointed to the shared newsletter provider as the source. Within hours, the crypto community had identified Brevo as the common thread across all three companies.

The Brevo connection

Brevo, rebranded from Sendinblue in 2023, is one of the most widely used email delivery and marketing platforms around, serving hundreds of thousands of customers and processing billions of emails a month. Its client base spans e-commerce, SaaS, finance, and, in this case, cryptocurrency hardware and services companies.

Companies that sign up with Brevo typically integrate via API keys, connect verified sending domains, and upload subscriber lists. That means Brevo’s infrastructure holds the keys to sending emails that pass all standard authentication checks on behalf of those companies. If an attacker compromises a Brevo customer account, or Brevo’s own infrastructure or access controls, they inherit the ability to send emails that are cryptographically authenticated as coming from the legitimate domain.

This is a supply chain compromise. Instead of attacking Trezor’s or BitBox’s internal systems directly, the attackers went after a shared dependency: the email delivery layer. One compromised vendor turned every downstream customer into a potential target.

Brevo’s own documentation acknowledges that compromised customer accounts can be misused for fraud, but its security measures weren’t enough to stop the attackers, whether they accessed customer accounts directly or exploited a broader infrastructure gap to send unauthorized campaigns.

The full scope of the Brevo compromise is still under investigation. It’s not yet clear whether the attackers exploited a zero-day in Brevo’s systems, used stolen API credentials, ran a social engineering attack against Brevo staff, or found a vulnerability in one of Brevo’s own upstream dependencies. What is confirmed is that several crypto companies using Brevo were affected at roughly the same time, which points to a compromise at the provider level rather than individual company accounts.

Anatomy of the phishing email: the fake STM32 entropy vulnerability

The email had enough technical plausibility to fool people who know something about hardware wallet architecture but don’t follow firmware security research closely.

The subject line read “Critical Security Alert: STM32 Entropy Vulnerability.” It claimed a flaw in the STM32 microcontroller, a chip family used in several hardware wallet products, had compromised entropy generation and made wallet recovery phrases potentially predictable. Recipients were told to run a linked “entropy check” tool to see if their wallet was affected.

Why this angle works

STM32 microcontrollers, made by STMicroelectronics, really are used in hardware wallets. Trezor’s original Model One used an STM32F205. There’s also a real, documented history of research into random number generation and entropy sources in embedded systems. By referencing a real component, the attackers gave the email a layer of credibility a generic “your account has been compromised” message wouldn’t have had.

But no such STM32 entropy vulnerability affecting hardware wallet recovery phrases exists, at least not in the way the email described. Trezor’s current lineup (Model T and Safe 3/5) uses different secure element designs. BitBox devices run their own security implementations. The “entropy check” tool was a phishing page built to get users to type in their 12- or 24-word recovery seed, which would then go straight to the attackers.

Technical indicators in the email

A few things should have raised suspicion despite the legitimate sending infrastructure:

The linked domain didn’t match Trezor (trezor.io), BitBox (shiftcrypto.ch), or CoinTracking (cointracking.info). The phishing links pointed to newly registered domains hosting the fake tool.

The urgency framing, “Critical,” “immediately,” “your funds are at risk,” is a standard phishing tell. Legitimate security disclosures from hardware wallet manufacturers follow a responsible disclosure timeline and post detailed technical advisories on their own blogs rather than sending a single panic-inducing email with one link.

Asking users to enter a seed phrase into a web tool is the biggest red flag in cryptocurrency security. No legitimate hardware wallet manufacturer will ever ask you to enter your recovery phrase anywhere other than the physical device itself during recovery.

Timeline of events and company responses

The attack moved fast, and the response shows both the strengths and the limits of incident response when the compromise sits with a vendor, not the company itself.

Trezor spotted the unauthorized emails going out from its domain through the compromised provider and issued a public warning through its official channels, confirming the “STM32 Entropy Vulnerability” email wasn’t sent by Trezor and telling users not to click any links.

Trezor said it took down the phishing domain and was investigating how the attackers got access to its sending domain through the provider, and emphasized that the breach happened at the third-party email level, not inside Trezor’s own systems.

About an hour after the phishing emails went out, BitBox published its own alert. Its preliminary review pointed to its newsletter provider as compromised. BitBox warned all newsletter subscribers, contacted the provider directly, and reported the phishing domains to authorities and domain registrars. Most of the phishing links came down fairly quickly.

As the investigation went on, it became clear CoinTracking, a cryptocurrency portfolio and tax reporting service, was hit too. Multiple companies being affected at the same time confirmed the shared-provider theory and pointed at Brevo.

Both Trezor and BitBox confirmed the malicious domains hosting the fake entropy check tools were reported and taken down, though the window they were live was long enough for some users to fall for it, especially given how convincing the emails looked.

Why email authentication couldn’t stop this

Understanding why SPF, DKIM, and DMARC didn’t flag these messages matters for anyone thinking about email security more broadly.

SPF (Sender Policy Framework) lets domain owners specify which mail servers can send email on their behalf. Because Trezor, BitBox, and CoinTracking had legitimately authorized Brevo’s mail servers in their SPF records, the phishing emails passed SPF validation. As far as the receiving mail server was concerned, the email came from an authorized source.

DKIM (DomainKeys Identified Mail) adds a cryptographic signature so the recipient’s mail server can verify the message wasn’t tampered with and was signed by the domain’s authorized sending infrastructure. Since Brevo held the DKIM signing keys for these companies as part of the delivery arrangement, the phishing emails carried valid DKIM signatures too.

DMARC (Domain-based Message Authentication, Reporting, and Conformance) builds on SPF and DKIM to set policy for messages that fail authentication. Since the phishing emails passed both, DMARC had nothing to flag.

That’s the core problem with a supply chain compromise at the email delivery layer: authentication verifies who is sending the email, not whether the content is legitimate. When the authorized sender is compromised, every protocol-level safeguard becomes useless, and detection has to fall back on content analysis, user vigilance, and systems that can catch unusual sending patterns.

What the attackers were after: recovery seed phishing

The goal was straightforward: steal cryptocurrency wallet recovery seed phrases.

A hardware wallet like a Trezor or BitBox generates and stores a recovery seed, usually a 12- or 24-word phrase derived from randomness using the BIP-39 standard. That seed is the master key every private key and address in the wallet is derived from. The device stores it in a secure element, and under normal use, it never leaves the device.

But during setup or recovery, the user does see the seed phrase. If an attacker gets it, by tricking someone into typing it into a phishing site, they can rebuild the wallet on any compatible device and drain it. No amount of hardware security, PIN protection, or passphrase encryption matters once the seed itself is compromised.

That’s why every hardware wallet manufacturer tells you the same thing without exception: never enter your recovery seed phrase into a website, app, computer, or phone. The only place it should ever go is the hardware wallet device itself, during recovery.

The fake “entropy check” tool was built to get around that rule by creating urgency around a vulnerability that doesn’t exist.

Supply chain risk in crypto

This isn’t an isolated incident. Reliance on third-party SaaS providers for email delivery, customer support, analytics, and infrastructure creates connected risk that a lot of companies in this space haven’t fully dealt with.

The 2022 Mailchimp breach is a close parallel: attackers accessed Mailchimp’s internal tools to target crypto companies’ customer lists. The pattern holds up: rather than attack well-defended crypto companies directly, threat actors go after the marketing, email, and communication vendors those companies depend on, where security may be weaker and the blast radius of one compromise is much larger.

Crypto companies are attractive targets because the payoff is immediate and irreversible. Unlike a data breach where stolen credentials get reset or fraud gets reversed through a bank, crypto transactions are final. Once an attacker has a seed phrase and moves funds, there’s no chargeback and no customer support line to call.

Email newsletter providers sit in a particularly sensitive spot in the trust chain. They hold subscriber lists (essentially lists of confirmed, engaged users of a crypto product), they can send authenticated emails, and they often have API access that could support further reconnaissance. A compromise here doesn’t just enable phishing, it can let attackers enumerate the whole user base and build targeted follow-up attacks.

What users should do right now

If you subscribe to email newsletters from Trezor, BitBox, CoinTracking, or any crypto service, here’s what matters:

Immediate actions

Don’t click any links in a recent email claiming to be a security alert from your hardware wallet provider or any crypto service, even if it looks legitimate. If you’re unsure, go directly to the company’s website by typing the URL in yourself, not by clicking a link in an email.

If you clicked the link but didn’t enter your seed phrase, clear your browser cache, run a malware scan, and watch your wallet addresses for unauthorized transactions.

If you entered your seed phrase on the phishing site, treat the wallet as compromised. Using a separate, clean device, create a new wallet with a new seed and move all funds over as fast as you can. If the funds are already gone, report it to your local cybercrime authority and to the affected company’s team.

Turn on a BIP-39 passphrase (the “25th word”) if you haven’t already. It adds a layer of protection beyond the seed phrase itself, since an attacker with your 12 or 24 words still can’t access funds without the passphrase. Just make sure you store it somewhere safe, because losing it means losing the funds.

Ongoing habits

Verify communications through official channels. Trezor’s blog is at blog.trezor.io, BitBox posts updates at shiftcrypto.ch, and CoinTracking’s official domain is cointracking.info. Bookmark these and check them if an email seems off.

Use a dedicated email address for crypto services, separate from general signups. It limits the blast radius if that address shows up in a breach and makes suspicious emails easier to spot.

Turn on multi-factor authentication everywhere connected to your crypto holdings, including exchange, email, and portfolio-tracking accounts. A hardware security key beats SMS-based 2FA when it’s an option.

Be skeptical of urgency. “Critical,” “immediate action required,” “your funds are at risk” is the vocabulary of social engineering. Real security teams give you time and detailed information, and they never ask you to enter sensitive material through a link.

Update firmware only through official companion apps (Trezor Suite, BitBoxApp) downloaded from the manufacturer’s site, never through a link in an email.

What the affected companies should be doing

The response from Trezor, BitBox, and CoinTracking was fast and transparent, which is worth noting. But the incident should push a broader rethink of third-party vendor risk in crypto.

Companies that handle crypto users’ contact information and can send authenticated email on their behalf should get real security scrutiny before and during the relationship, including SOC 2 Type II reports, penetration testing results, access control policies, and incident response procedures. The question to ask is: if this vendor is compromised, what’s the worst case for our users, and what stops it?

Where possible, companies should limit what access they hand a provider: separate API keys for transactional versus marketing email, multi-person approval before sending to a full list, and anomaly detection on volume and content. A provider account suddenly sending 200,000 emails with a new link pattern at 2 a.m. should trigger an alert, or a sending freeze.

Communication during an incident matters too. Trezor and BitBox both used channels beyond email itself, since email was the compromised channel, to get the warning out.

Depending on jurisdiction, the breach and its use for phishing may trigger notification obligations under GDPR, the UK’s Data Protection Act, or various U.S. state privacy laws, so affected companies should be talking to legal counsel about what they owe users and regulators.

The broader picture for email security in crypto

This incident points to a structural weakness in how the crypto industry talks to its users. Leaning on centralized email delivery platforms creates a single point of failure that, once exploited, undermines trust in the whole channel.

Some security researchers have started pushing for more decentralized or multi-channel approaches to critical security notifications, things like in-app push notifications, signed RSS feeds, or other non-email channels for anything urgent. None of these fully replace email, but relying less on a single provider for security-critical messages would shrink the attack surface.

Realistically, email isn’t going anywhere as the primary channel here, which means the security of email delivery infrastructure needs the same level of scrutiny companies already give their wallets.

How to spot phishing emails: a quick checklist

Even when SPF, DKIM, and DMARC all pass, there are ways to catch a phishing email:

Check the sender domain, not just the display name. In this case the sending domain was legitimate, which is what made this campaign harder to catch than most, but checking the domain is still worth doing by default.

Hover over links before clicking. In this campaign, the links went to domains with no connection to Trezor or BitBox. Watch for misspellings, extra subdomains, or an unexpected top-level domain.

If you’re comfortable reading headers, check “Received,” “Return-Path,” and “Authentication-Results.” Here they would have shown Brevo’s servers, which is legitimate, but the linked URLs would have given it away.

Never enter sensitive information through an email link. Your seed phrase shouldn’t be typed into a website, sent in an email, or given to anyone claiming to be from a wallet company, no exceptions.

When in doubt, go to the source directly: open a new tab, type in the company’s real URL, and check for a security notice there. A genuine vulnerability gets a documented advisory with technical detail, not a single email link.

Final assessment

The hardware wallets themselves weren’t compromised. No firmware bug was exploited, no secure element was breached. The attack worked, or came close to working, entirely through social engineering enabled by a compromise in a third-party vendor. The weak point wasn’t the cryptography. It was the email provider, an unglamorous SaaS dependency most users never think about.

Guard your seed phrase like it’s the only thing standing between you and losing everything, because it is. Never enter it anywhere except on your hardware device. Treat every email, however legitimate it looks, with some skepticism, and verify anything urgent through official channels first.

For companies in this space, third-party vendor risk isn’t a procurement checkbox. It’s a security discipline that affects the financial safety of their users directly.

The investigation into the Brevo breach is ongoing, and affected companies say they’ll share more details as they come in.