Solana Mobile disclosed that a security incident occurred at third-party marketing email service provider Brevo, affecting some customer accounts, including Solana Mobile's own account. The team immediately suspended the account after discovering unauthorized access and is verifying the scope of the information accessed with Brevo.

Brevo's official statement later indicated that attackers exploited a boundary flaw in its SAML single sign-on, accessing 138 customer accounts between approximately September 9 and 10. Six accounts were used to send phishing emails to contacts, 43 accounts had their contact lists exported, while 93 accounts showed no substantial activity. Brevo closed the attack vector around 8:30 UTC on September 10 and forced logout of all platform sessions.

Hardware wallet manufacturer Trezor confirmed that about 347,000 newsletter subscribers received spoofed official emails on September 9, with the subject "Critical Security Alert: STM32 Entropy Vulnerability," which included links that induced users to download applications and request wallet backups. Trezor stated that approximately 2,500 people clicked on the malicious link before it shut down the domain within 20 minutes. BitBox and CoinTracking also reported that their Brevo accounts were used in similar attacks.

Solana Mobile stated that, as of now, it has not found any emails sent from its account but is still cross-verifying sending logs and export records with Brevo. The company emphasized that it will never ask for mnemonic phrases, private keys, or wallet recovery information. Once the email list is exported, there may still be follow-up phishing attempts impersonating Solana Mobile, Seeker pre-orders, or SKR-related notifications.

This attack did not affect the Solana on-chain protocol, Seeker device firmware, or user wallet private key storage; the exposure was concentrated on marketing contact lists and sending permissions. Attackers first created Brevo accounts and enabled SSO, then invited real users into that SSO configuration, impersonating invited users through the identity provider to incorrectly gain access to all organizational permissions, turning the marketing SaaS into a targeted phishing channel.

From a market mechanism perspective, this is event-driven supply chain phishing, not a protocol vulnerability sell-off. The flow of funds still follows the "phishing for mnemonic phrases—transferring on-chain assets" path, with the pressure on those using the same email service provider for crypto hardware wallets, tax tools, and consumer hardware brands; the beneficiaries are users who continue to hold cold storage and refuse to click email links. The SOL spot and on-chain settlement layer did not experience structural selling pressure due to this incident; short-term volatility is more driven by sentiment and the speed of phishing email dissemination rather than validator or liquidity pool withdrawals.

Source: Public Information