Solana Mobile Suspends Brevo Account Following Unauthorized Access
Solana Mobile disclosed that a security incident occurred at third-party marketing email service provider Brevo, affecting some customer accounts, including Solana Mobile's own account. The team immediately suspended the account after discovering unauthorized access and is verifying the scope of the information accessed with Brevo.
Brevo's official statement later indicated that attackers exploited a boundary flaw in its SAML single sign-on, accessing 138 customer accounts between approximately September 9 and 10. Six accounts were used to send phishing emails to contacts, 43 accounts had their contact lists exported, while 93 accounts showed no substantial activity. Brevo closed the attack vector around 8:30 UTC on September 10 and forced logout of all platform sessions.
Hardware wallet manufacturer Trezor confirmed that about 347,000 newsletter subscribers received spoofed official emails on September 9, with the subject "Critical Security Alert: STM32 Entropy Vulnerability," which included links that induced users to download applications and request wallet backups. Trezor stated that approximately 2,500 people clicked on the malicious link before it shut down the domain within 20 minutes. BitBox and CoinTracking also reported that their Brevo accounts were used in similar attacks.
Solana Mobile stated that, as of now, it has not found any emails sent from its account but is still cross-verifying sending logs and export records with Brevo. The company emphasized that it will never ask for mnemonic phrases, private keys, or wallet recovery information. Once the email list is exported, there may still be follow-up phishing attempts impersonating Solana Mobile, Seeker pre-orders, or SKR-related notifications.
This attack did not affect the Solana on-chain protocol, Seeker device firmware, or user wallet private key storage; the exposure was concentrated on marketing contact lists and sending permissions. Attackers first created Brevo accounts and enabled SSO, then invited real users into that SSO configuration, impersonating invited users through the identity provider to incorrectly gain access to all organizational permissions, turning the marketing SaaS into a targeted phishing channel.
From a market mechanism perspective, this is event-driven supply chain phishing, not a protocol vulnerability sell-off. The flow of funds still follows the "phishing for mnemonic phrases—transferring on-chain assets" path, with the pressure on those using the same email service provider for crypto hardware wallets, tax tools, and consumer hardware brands; the beneficiaries are users who continue to hold cold storage and refuse to click email links. The SOL spot and on-chain settlement layer did not experience structural selling pressure due to this incident; short-term volatility is more driven by sentiment and the speed of phishing email dissemination rather than validator or liquidity pool withdrawals.
Source: Public Information
ABAB AI Insight
Solana Labs has relied on pre-order lists and email outreach for growth on the Saga generation phone, with the Saga super app and Chapter 2 empty investment qualifications depending on the same user funnel. The breach of the Brevo account effectively re-exposes the email assets accumulated from the last two rounds of hardware pre-sales to phishing groups. Trezor has previously warned users multiple times about incidents involving third-party service providers, indicating that the hardware wallet industry has outsourced "sending rights" to marketing SaaS, shifting the security boundary from chip entropy sources to CRM login states.
The capital path is clear: crypto hardware companies aim to reduce customer acquisition costs to email click rates, handing over the most sensitive verified email addresses in bulk to general marketing platforms like Brevo. Attackers do not need to breach security chips; they only need to gain SSO overreach to turn 347,000 Trezor emails and potential Solana Mobile pre-order lists into reusable bait. The resource mobilization method is "low-cost account creation—inviting internal users—gaining full organizational permissions horizontally—exporting lists or directly mass mailing," with investment far lower than attacking the chain, and returns directly corresponding to on-chain transferable assets.
Similar structures have already appeared in the Ledger Connect Kit front-end being poisoned, Slope wallet mnemonic phrases uploaded to the cloud, and multiple exchange customer service emails being spoofed. The industry phase has shifted from "expanding capacity, launching airdrops" to "controlling access points." Whoever controls verified user emails can extract funds without touching contracts. Solana Mobile is not currently expanding Seeker but is filling the trust gap in the supply chain.
Structurally, this represents a reconstruction of the industry chain: security responsibility has shifted from self-custodied hardware to third-party SaaS identity boundaries. The mechanism is a transfer of pricing power—users think they are buying offline signing devices, but the actual pricing factor becomes whether the marketing service provider has locked down the SSO scope. Once the boundary fails, the narrative of cold wallets is immediately breached by email links, and capital will reprice "self-built sending infrastructure" and "minimum permission CRM" rather than continue to give the same growth email tools a premium.
ABAB News · Cognitive Laws
The most expensive assets are often placed in the cheapest outsourcing.
If you can't breach the chip, breach the sending rights.
User lists are closer to cash than protocol vulnerabilities.