Digital Wallet
By Bruce Buterin
1 / 15
Three Platforms, One Broken System. Trezor moved fast. The company sent warnings to affected subscribers and confirmed that only email…
2 / 15
Brevo's Authorization Failure. The core problem here is an authorization boundary that didn't hold.
3 / 15
A login vulnerability in Brevo's system let an attacker blast phishing emails to 347,000 Trezor subscribers. It didn't stop there.
4 / 15
The attacker's method was pretty simple, which makes it worse. They created a Brevo account, then invited legitimate users into it.
5 / 15
Because the messages traveled through Brevo's own infrastructure, they passed standard authentication checks without raising flags.
6 / 15
Trezor moved fast. The company sent warnings to affected subscribers and confirmed that only email addresses were exposed — no additional customer data, no seed phrases, no funds…
7 / 15
BitBox confirmed the same thing. Its full newsletter and tutorial list went through Brevo, which means every address on it was potentially exposed.
8 / 15
CoinTracking's situation was slightly different in tone. The platform issued a warning about an email with the subject "Data Breach Notice: Please refresh API Keys as soon as…
9 / 15
See also: Trezor Users Targeted by Phishing Attack Using Legitimate Email Infrastructure
10 / 15
The core problem here is an authorization boundary that didn't hold. Brevo's system failed to keep one client's access separate from another's.
11 / 15
It's murky exactly how that boundary broke down. Brevo acknowledged the breach but hasn't put out a detailed technical explanation.
12 / 15
That wait is uncomfortable. Email marketing platforms sit at a weird intersection — they hold contact lists for hundreds of clients, process sensitive communications, and act as…
13 / 15
Crypto users are already primed targets for phishing. Hardware wallet holders especially — attackers know they're likely holding real assets and that a convincing enough scare…
14 / 15
Related: Anthropics Claude AI Blocks Grant for Controversial Biological Weapons Research
15 / 15
And the 2,500 users who clicked the link before Trezor disabled it? Unclear what happened to them specifically.
The Currency Analytics
Want the full story?