Weekly Brief 16.09.2026: Brevo leak affects trezor. Weekly brief for the Baltics and Northern Europe: A leak from the Brevo email platform (10-11 September) triggered a wave of phishing attacks targeting Trezor and BitBox hardware wallet users. Toms Ābeltiņš No new, clearly dated events in its segment over the past 24 hours. The main event of the week (10-11 September): A leak from the Brevo email platform triggered a wave of phishing attacks targeting Trezor and BitBox hardware wallet users; email addresses were affected, not devices or seeds. Wednesday, 16 September 2026. This is a 'Weekly Brief' format publication. Over the past 24 hours, there have been no new, clearly datable significant events in its segment - crypto exchanges and CASPs, hardware wallets, crypto cards, and tax tools serving the Baltics (LV, LT, EE) and Northern Europe (FI, SE, NO, DK). Therefore, today NorriWire offer a weekly overview with precise dates. The most clearly datable segment event of the week, not yet covered in its previous releases, is the wave of phishing attacks against hardware wallet users, publicised on 10-11 September, stemming from a security incident at the email marketing platform Brevo. Older, ongoing stories are presented as context, not as fresh news. Main event of the week: Brevo leak and phishing wave against hardware wallet users. On 10 and 11 September, several hardware wallet manufacturers warned customers about fraudulent emails impersonating official communications. The incident originated from a security leak at the email and newsletter platform Brevo (formerly Sendinblue). This event falls into the second category of its segment - hardware wallets - and partly into the fourth category, tax and portfolio tools, and is directly relevant to self-custody users in the Baltics and Nordics. According to Brevo's explanation, attackers gained access to approximately 120-140 customer accounts on the platform (various sources cite between approximately 120 and 138 accounts) due to insufficiently restricted access rights, and used these accounts to send phishing emails to the contact databases of the respective companies. In Trezor's case, approximately 347,000 fraudulent emails were sent. One of the recorded phishing emails used the subject line "Critical Security Alert: STM32 Entropy Vulnerability" and urged recipients to follow external links. Hardware wallet manufacturer BitBox confirmed using the same newsletter provider: the company stated that "it seems we all share the same newsletter provider", contacted the service provider, reported the phishing domains, and noted that most links had already been removed. The same provider incident was also discovered around the same time by crypto tax and portfolio tracking tool CoinTracking, illustrating that the leak affected a broader range of crypto services, not just wallet manufacturers. It is crucial to emphasise the boundary: the devices themselves, wallets, or seed phrases were not compromised. Trezor announced that "none of its products, wallets, or account systems were affected by the incident", and that customer email addresses were compromised. For this very reason, the manufacturer warns that leaked email addresses may be reused in future phishing campaigns. Trezor's advice to users was unequivocal: do not click on links, never enter your wallet backup anywhere, and always confirm every action physically on the Trezor device. Context: supply chain leaks and attacks on the "human trust layer" (Reminder, not fresh news). These points are not news from the last 24 hours; NorriWire include them only for background, with precise previous dates. The September phishing wave fits into a broader theme this year, where attackers bypass the hardware device itself and target customer data stored with third-party service providers. In August, Trezor disclosed a separate incident with shipping fulfilment partner ShipMonk, affecting at least approximately 81,000 customers, revealing names, phone numbers, email addresses, and postal addresses. It is precisely such data that makes subsequent phishing attempts more convincing. NorriWire do not consider this incident as new in September; it is background explaining why users in the region are currently receiving unusually targeted fraudulent emails. This background also aligns with the year of hardware wallet security previously covered in its releases: BitBox's 17 August firmware patch (version 9.26.5), Coldcard (Coinkite)'s seed entropy incident in early August, and the discovery of the Trezor Safe 7 TROPIC01 chip laser attack (Ledger Donjon, 3 June). The distinction is important: the September event is not a device or firmware vulnerability, but a data leak at an email service provider, which translates into a social engineering risk. Practical recommendations for market participants. For self-custody users and retailers selling hardware wallets in the region, the practical course of action is relatively straightforward. Firstly, be cautious of any "security alert" email urging you to urgently click a link or enter a seed phrase; legitimate manufacturers never ask for a wallet backup. Secondly, every action should be physically confirmed on the device screen, rather than relying on email content. Thirdly, if a user's email has potentially been part of a leak, that address should be considered at permanently elevated phishing risk in the future. Fourthly, firmware and applications should only be updated from official sources (bitbox.swiss, trezor.io, and similar), not from email links. Regulatory and market background. On the regulatory side, no new MiCA CASP authorisations for Baltic or Nordic crypto exchanges have been publicly registered in the past week. The ESMA MiCA register continued to expand over the summer - after July updates, it contained more than approximately 294-309 CASP entries - but net growth is primarily driven by notifications from continental (especially German) credit institutions, not regional crypto exchanges. Finland's Finanssivalvonta reminds that the European regulatory framework for CASPs is fully complete, with the last ESMA guidelines entering into force on 28 July 2026; this is ongoing context, not fresh news. In Estonia, the previously covered insolvency process of zondacrypto operator BB Trade Estonia OÜ continues: the Harju County Court in Tallinn declared the company insolvent on 27 August (licence fully revoked on 29 June), and the deadline for submitting creditor claims is set for 27 October. NorriWire covered this story in more detail in a separate publication; here NorriWire mention it only as ongoing context and a point to watch. Brevo and supply chain leaks: NorriWire is monitoring for additional information on the number of affected accounts and whether other crypto service providers in the region (exchanges, tax tools, card issuers) have used the same supplier. zondacrypto / BB Trade Estonia: The creditor claims deadline of 27 October remains the key upcoming date. ESMA MiCA register: NorriWire is monitoring for upcoming updates regarding Baltic and Nordic firms. Norway's transitional regime: Following the end of the MiCA transition on 30 June, NorriWire is monitoring Finanstilsynet's progress with the authorisation status of local exchanges (Firi, K33, NBX, TÝR Markets). Sources.

Waltio confirms Brevo breach touched its user emails: here is what to do now. Waltio has told users its Brevo account was accessed during the September breach that also hit Trezor and BitBox. Here is what was exposed. Published: 09/15/2026 French crypto tax platform Waltio has started emailing its users about a security incident at Brevo, the third party email provider it uses to send campaigns. The message is calm, carefully worded, and mostly reassuring. It is also the latest confirmation that the Brevo breach of early September has a longer guest list than anyone first thought. If you are a Waltio user, your tax reports are fine. Your email address may not be. And in crypto, an email address in the wrong hands is not a small thing. Hasheur investisseur chez Waltio, faisant de la pub et disant d'utiliser Waltio avec son lien ref qui finalement sert aux criminels pour les kidnappings | DPM Waltio was a suspect for one of them What did waltio actually tell its users? The notice, sent in French under the heading "Information relative à la sécurité de vos données personnelles", sets out four points. * First, no malicious emails went out from Waltio's account. Nothing was blasted to the contact list pretending to be Waltio. * Second, Brevo's analysis is still running. Brevo has not been able to confirm whether the intruder actually viewed or exported Waltio's contact list, only that unauthorised access to the account happened. * Third, the data at risk is thin. The only fields Waltio keeps inside Brevo are the email address tied to your Waltio account and, if you entered it voluntarily, your French department number. That is the two digit administrative region code used in France, so 75 for Paris, 13 for Bouches du Rhône, and so on. Useful for regional tax messaging, and not much else on its own. * Fourth, the blast radius stops at Brevo. Waltio says the tool holds no passwords, no API keys, no wallet addresses, no transaction history and no tax data. Logins and connected exchanges are untouched. Waltio also notes that Brevo now treats the incident as closed. How big was The Brevo breach? Bigger than one French startup. Brevo said an attacker got into around 120 to 138 customer accounts on 9 and 10 September before access was cut off. The company later attributed it to an authorisation flaw in its login and single sign on layer rather than a classic password leak, which meant the attacker could reach every organisation the compromised invited users were entitled to see. Brevo's own breakdown split the damage three ways: a handful of accounts were used to send phishing, several dozen had contact lists exported, and the large majority showed no activity at all. Waltio's "analysis in progress" language suggests it is sitting somewhere between the second and third bucket, and does not yet know which. The names already confirmed are a who's who of crypto: Trezor, BitBox, CoinTracking and Solana Mobile. Trezor got the worst of it. Roughly 347,000 newsletter subscribers received a fake security alert about an STM32 entropy vulnerability, pointing to an app that asked for their wallet backup. Trezor killed the domain at DNS level within twenty minutes, but around 2,500 people had already clicked. Why does this matter more for waltio than for other Brevo clients? Because Waltio has been here before, and much worse. In January 2026 the platform suffered a genuine intrusion into its own systems, not a vendor's. Attackers exfiltrated data tied to tax report generation, contacted the company demanding a ransom, and the Paris prosecutor's cybercrime unit handed the investigation to the Gendarmerie's national cyber unit. Waltio confirmed that email addresses, aggregated crypto balances and tax report data had been exposed, while passwords, API keys, wallet addresses and banking details had not. A file circulating on Telegram afterwards was reportedly used to target French crypto holders directly. That history changes the maths on this new incident. A standalone email address is low value. An email address that can be cross referenced against a leaked file showing roughly how much crypto you hold is a targeting list. France has had a grim run of kidnappings and home invasions aimed at crypto holders, and those cases start with exactly this kind of data stitching. So the correct reading of the Waltio notice is not "nothing happened". It is "one more identifier of yours may now be in circulation, and you should assume the attackers are patient". How do you spot A waltio phishing email? The Brevo attack worked precisely because the phishing came through legitimate infrastructure. Sender domain checks, DKIM, SPF, the usual tells, all of it looked correct on the Trezor emails. So domain inspection alone will not save you here. Judge the ask instead: * Any message asking for your seed phrase or wallet backup is fraud. Always. Waltio states plainly that it will never ask for a seed phrase, a password or a transfer of funds, by email or by phone. * Any message pushing you to download an application to "fix" or "verify" something is fraud. * Any message creating a deadline, a legal threat or a tax penalty scare is worth a second look. Tax angles are the obvious hook for a Waltio user list. * Never click through from the email. Type waltio.com yourself, or contact support directly at [email protected]. What should waltio users do right now? Nothing dramatic, but a few things are worth doing this week. Turn on two factor authentication on your Waltio account and on every exchange it connects to, using an authenticator app rather than SMS. Review and revoke any exchange API keys you no longer use, and confirm the ones you keep are read only. Change your Waltio password if you have reused it anywhere else. Consider running your address through a breach checker to see what else about you is already public. One structural note is hard to avoid. Crypto tax tools sit on the richest dataset in the entire ecosystem, a complete picture of who owns what and where it sits. DAC8 reporting obligations across the EU are pushing more of that data into more places, not fewer. The Waltio notice is a reminder that the weakest link is rarely the platform itself. It is the newsletter tool bolted onto the side of it. Keeping your keys off the internet entirely is still the strongest answer to any phishing campaign. The CryptoTicker shop stocks hardware wallets at shop.cryptoticker.io.