CoinTracking, a Munich-based platform used by more than 2 million people to track crypto portfolios and prepare tax reports, said its third-party email provider Brevo suffered a security breach.
Our third-party email service provider Brevo has experienced a security breach.
Please note that the email titled "Data Breach Notice: Please refresh API Keys as soon as possible" was not sent by us and is a phishing attempt.
Do not click on any… pic.twitter.com/MqIsDkOqE3— CoinTracking (@Coin_Tracking) September 9, 2026
- The company warned in an X post on Thursday, Sept. 10, that an email titled "Data Breach Notice: Please refresh API Keys as soon as possible" was fake and told users not to follow any links inside it.
- CoinTracking hasn't yet disclosed how the attackers gained access, how many people received the email or what information, if any, was exposed through Brevo.
- The Coinformer reached out to CoinTracking for more details and will update the story if it responds.
It happened before
It's the second similar incident involving one of CoinTracking's outside email services in less than a year.
- In November 2025, an attacker gained access to CoinTracking's account at SendGrid, a different email-delivery provider, and used its verified sender domain to distribute phishing emails.
The attacker uploaded a list of 127,973 addresses and successfully delivered about 115,000 emails, according to CoinTracking.
Around 3,668 of the recipients were CoinTracking users.
CoinTracking said at the time that neither its own systems nor customer data had been accessed. It subsequently reset SendGrid credentials, confirmed two-factor authentication, introduced IP restrictions and added further monitoring and access controls.
Brevo and SendGrid are separate companies, meaning the latest incident is not simply a recurrence at the same breached provider.
Crypto firms face another email attack
The warning also comes as other crypto companies report strikingly similar attacks.
Crypto hardware wallet maker Trezor said on Sept. 9 that its third-party email provider had been breached after customers received a fake alert claiming a vulnerability in their devices could compromise their recovery phrases.
Our third-party e-mail provider has been breached. Please be aware that the email named 'Critical Security Alert: STM32 Entropy Vulnerability' is not coming from us, and it's a phishing attempt. Do not click on any link.
— Trezor (@Trezor) September 9, 2026
We have taken down the domain, and we are investigating…
YFarmX, a crypto security research outlet, found that Trezor's authenticated mailing infrastructure was linked to Brevo, although Trezor itself has so far referred only to an unnamed third-party provider.