Email Breach Puts Crypto Customers in Scammers' Crosshairs

An email marketing company called Brevo was breached, exposing customer lists for cryptocurrency platforms like Trezor, CoinTracking, and BitBox. Scammers now have the names and email addresses of people who own crypto, and they're sending targeted phishing emails designed to steal login credentials and drain accounts.

This is a specific, high-value target list. If you use any of these platforms, you're likely in the breach. Here's what you need to know.

What happened in this breach?

Brevo stores and sends marketing emails for thousands of businesses. When hackers accessed Brevo's systems, they gained access to customer contact lists. That means scammers now know your email address and that you use one of these cryptocurrency services. They're using that information to send you fake emails that look like legitimate account alerts.

How will the scammers use my email address?

They'll send you emails that look like they're from Trezor, CoinTracking, BitBox, or another crypto platform. The email will tell you something urgent needs your attention: your account was accessed from a new device, your password needs to be reset, unusual activity was detected. Then it will ask you to click a link and sign in. That link goes to a fake website designed to capture your login credentials. Once they have your username and password, they can access your actual account and transfer your crypto to their wallet.

What should I do right now?

First, assume your email address is on this list. Set up email filters to catch phishing attempts. Most email providers let you flag emails from supposed company addresses that don't match the real domain. When you get an email claiming to be from your crypto platform, do not click the link. Instead, open a new browser tab, go directly to the official website by typing it in yourself, and log in there. If there's a real account issue, it will show up when you log in the legitimate way. Also enable two-factor authentication (a second login step that uses your phone or a security key) on all your crypto accounts if you haven't already. This stops scammers from accessing your account even if they have your password.

What about Android phones and hidden banking apps?

Separately, security researchers found a malware threat called Gigabud that specifically targets Android phones. This malware clones your actual banking app into a hidden section of your phone that you can't see. The scammer's copy of your app captures your login information when you use it, and they can drain your account without you knowing. The hidden copy of the app means fraudulent transactions happen outside your view. If you use banking apps on an Android phone, keep your phone's software up to date, only install apps from Google Play, and regularly review your bank statements and transaction history. If you see transactions you didn't make, contact your bank immediately.

You're not in danger if you stay alert and verify before you click. The scammers are counting on speed and urgency. Take a breath and verify first.