Brevo security flaw exploited in phishing attack affecting 347K Trezor users
Email platform vulnerability exposed crypto wallet subscribers to fraudulent messages.
1The Brevo security breach
A critical flaw in email platform Brevo's login system allowed attackers to access 138 client accounts. This vulnerability enabled phishing emails to reach approximately 347,000 subscribers of Trezor's newsletter. The breach also affected customers of BitBox hardware wallets and CoinTracking platform through similar fraudulent messages.
2How the attack unfolded
The attacker created a Brevo account and enabled single sign-on, then invited legitimate users into the configuration. Due to a failed authorization boundary, this granted access to all organizations those users could reach. Six accounts were used to send phishing emails, while contacts were exported from 43 accounts.
3Trezor's response
Trezor's phishing email appeared as a 'Critical Security Alert' about an STM32 entropy vulnerability. It contained a malicious link requesting wallet backups. The company disabled the domain within 20 minutes, but about 2,500 people accessed it first. Trezor is treating all 347,000 newsletter addresses as potentially compromised.
4Impact on BitBox
BitBox confirmed unauthorized emails reached its full newsletter and tutorial list through Brevo. While only email addresses and language preferences were stored, the company is treating its entire list as potentially accessed. No evidence of compromised credentials or lost funds was found, but they await Brevo's logs for confirmation.
5CoinTracking's situation
CoinTracking's Brevo account distributed a fake 'Data Breach Notice' email urging users to refresh API keys. The company warned recipients not to follow the email's links. Like others, they're assessing the full impact while working with Brevo to understand the security failure's extent.
6Brevo's postmortem findings
Brevo's investigation revealed that 93 accounts showed no meaningful activity during the breach. The platform hasn't clarified whether the affected account categories overlapped. The company faces scrutiny for its authorization system failure that allowed cross-organization access.
7Industry-wide implications
This incident highlights vulnerabilities in third-party email platforms used by crypto companies. The attack's sophistication—bypassing normal authentication checks—demonstrates evolving phishing techniques. Crypto firms must reassess their vendor security protocols and customer communication safeguards.
8Ongoing risks
With 347,000 email addresses potentially exposed, there's significant risk of follow-up phishing attempts. Trezor warns these addresses may be reused for future attacks. The incident underscores the crypto industry's need for more secure communication channels beyond traditional email platforms.