A Brevo login flaw has been identified as the root cause of the recent phishing campaign targeting Trezor and BitBox customers. According to Brevo's postmortem report, the attacker exploited a weakness in Brevo's single sign-on system, gaining access to 138 customer accounts that were used by Trezor, BitBox, and CoinTracking. The flaw allowed the attacker to access organizations connected to legitimate users who had been invited into an attacker-controlled Brevo account. As reported by Brevo, the attacker first created a Brevo account and enabled single sign-on before inviting legitimate Brevo users into the newly created organization. However, an authorization boundary failed, allowing the attacker to reach every organization that the invited users themselves had permission to access.
The phishing emails were sent through six compromised accounts while contacts were exported from 43 accounts, with Brevo recording no meaningful activity across another 93 accounts. Trezor's Brevo account contained approximately 347,000 opt-in newsletter email addresses, with no other customer information stored on the platform. According to Trezor, the initial phishing message was sent to all 347,000 addresses, with around 2,500 people accessing the malicious link before Trezor took the domain offline at the DNS level within 20 minutes. Trezor is treating all 347,000 newsletter addresses as potentially known to the attacker and reusable for phishing, as the company has not received confirmation that all addresses were exported.
The scope of the Trezor data breach has expanded significantly following a September 4 update. The initial August 13 disclosure affected 13,689 customers with full personal data exposure (names, emails, phone numbers, shipping addresses), while an additional 67,000 US customers from older order archives covering November 2019-August 2021 were exposed in the September update. According to Help Net Security reporting, customers are now receiving phishing calls referencing their real order details and physical letters containing QR codes designed to look like official Trezor communications. The combined total of affected customers now stands at approximately 80,689 people across both disclosures. Trezor has not reported any loss of cryptocurrency due to the latest phishing campaign.
BitBox has issued a similar warning after its newsletter provider was likely compromised, with several Bitcoin companies appearing to have been targeted through the same provider. As reported by BitBox, the company's preliminary investigation found that its newsletter provider was likely compromised after phishing emails impersonating the hardware wallet company reached users. BitBox warned subscribers about the phishing attempt while continuing to investigate the incident. The attack came weeks after BitBox patched two wallet vulnerabilities involving firmware installation and Bitcoin address handling, with the company reporting no known exploitation of either flaw and no stolen user funds. CoinTracking customers received a different phishing lure designed around the service's portfolio tracking and tax-reporting functions, with the fraudulent email carrying the subject line 'Data Breach Notice: Please refresh API Keys as soon as possible'.
The Trezor and BitBox incidents highlight broader security challenges in the hardware wallet industry during 2026. According to Help Net Security, SafePal disclosed a separate breach around the same period, while Coinkite's Coldcard wallet suffered a firmware-level exploit in July 2026 that resulted in approximately $116 million in funds stolen. Enterprise blockchain security firm Holborn has attributed the ShipMonk intrusion to ShinyHunters, an extortion-focused group active in several major 2026 data-theft incidents. The pattern shows attackers targeting everything around the core wallet security - fulfillment vendors, firmware pipelines, and now apparently years-old customer databases that vendors failed to delete properly.
