Today’s Field Note

Two custody stories worth your attention. Trezor says a login flaw at its email vendor Brevo let attackers blast a phishing email to 347,000 subscribers; 2,500 clicked the malicious link. Trezor is treating every one of those addresses as compromised and reusable, which means the phishing does not stop with one wave. Separately, Blockstream refused a ransom demand for the roughly 600 BTC still held from the Liquid exploit, opting to work with law enforcement and exchanges instead. Liquid has resumed transactions but peg-outs remain disabled, so anyone with funds bridged into Liquid is still stuck.

Today’s Move

  • If you own a Trezor, assume your email is on the leaked list. Treat any message referencing your device, seed, or a “security update” as hostile, and never type a seed anywhere but the device itself.
  • Verify firmware and any prompts only through Trezor Suite directly, not links in email. Bookmark the real domain and stop trusting inbound mail entirely.
  • If you hold assets on Liquid, do not expect peg-outs today. Hold, do not attempt workarounds, and watch Blockstream’s official channel for the peg-out re-enable.
  • Watch the Liquid exploit address for movement of the 600 BTC; flag any flow into exchange deposit wallets so it can be frozen.
  • Same phishing wave hit BitBox and CoinTracking subscribers via Brevo. If you use either, apply the same email-hostile posture and rotate account passwords.

Resources

  • https://www.bleepingcomputer.com/news/security/trezor-347-000-users-targeted-in-phishing-attacks-after-brevo-breach/
  • https://www.theblock.co/news/ecosystems/2026-09-11-return-the-bitcoin-blockstream-refuses-ransom-demand-for-remaining-600-btc-from-liquid-exploit-414247
  • Incident trackers (reference standard): Rekt leaderboard · SlowMist Hacked

More: Issues · Field Notes · RTFM

Daily field notes, weekly Issues. Follow @ItsAlreadyPrice or subscribe via RSS.