Cybersecurity Breach: Hackers Exploit Email Provider to Target Cryptocurrency Users On Wednesday, thousands of cryptocurrency holders received phishing emails after hackers breached Brevo, a Paris-based email marketing provider, compromising 138 customer accounts. Six of these accounts were used to send malicious emails to stored contacts, while attackers exported data from 43 accounts. Key Details: - Who: Hackers targeted customers of Trezor, CoinTracking, and BitBox, among other crypto firms sharing the same newsletter provider. - What: Phishing emails, disguised as urgent security alerts, directed users to fake websites mimicking legitimate platforms. Examples included: - Trezor: "Critical Security Alert: STM32 Entropy Vulnerability" - CoinTracking: "Data Breach Notice: Please refresh API Keys as soon as possible" - How: Attackers exploited a system vulnerability to steal login credentials and expand access. Brevo confirmed a permanent fix has been deployed. - When: The breach occurred on Wednesday, with Brevo releasing a postmortem on Thursday. - Impact: Victims reported near-identical phishing sites, raising concerns about the exposure of cryptocurrency owners’ data. The incident follows Trezor’s recent breach, where 81,000 customers’ personal details were exposed, and a rise in "wrench attacks" physical assaults on crypto holders with losses reaching $124 million in 2025. Brevo has since revoked the attackers’ access and is cooperating with authorities. Affected companies, including Trezor and BitBox, issued warnings and took down malicious domains. The attack underscores ongoing risks in the cryptocurrency sector, where stolen user data is increasingly weaponized.