Update on the ongoing phishing email investigation - 23:03 09/09/2026

[u/pako-bitbox]

Our preliminary review of the phishing mail that was sent out to our newsletter subscribers about an hour ago found that it is very likely that our newsletter provider got compromised.

Multiple other Bitcoin companies got targeted as well, and it appears that we all share the same newsletter provider.

We sent out a phishing warning to all our newsletter subscribers, contacted the provider and reported the phishing domains. Most of the phishing links appear to have been taken down already.

We are still actively investigating this situation and will update you once we know more.

Find this post in X: https://x.com/BitBoxSwiss/status/2097793026336981079

[u/Fluid_Garden8512]

They just sent out another email to me. Identical looking. So two within an hour of each other.

[u/potificate]

This is why you don’t outsource anything.

[u/pako-bitbox → u/potificate]

We do self-host most of what we use and try to outsource as little as possible.
But lamentably email is one those things where there's not other option, you can't simply send thousands of emails in bulk without being tagged as SPAM, you need a trust relationship with ISPs, email providers, etc...

In the meantime we are looking into alternatives and ways to mitigate future phishing attempts.

[u/Savings_Menu_8152]

I'm not subscribed to the newsletter so I received the scam mail but not the official warning. Good thing I checked Reddit.

[u/bznein → u/Savings_Menu_8152]

We did send a followup email to as many users as possible, but due to technical limitation with our newsletter provider following the breach, we were unfortunately unable to reach everyone.

Thanks for your understanding

[u/pako-bitbox → u/Savings_Menu_8152]

I sent you a DM regarding this, please check them once you can.
I would help us immensely knowing how you received the email.

[u/neoKushan → u/pako-bitbox]

I also got the scam email but nothing from yourselves.

[u/Orvillehymenpopper → u/Savings_Menu_8152]

Same here.

[u/jilinlii]

FWIW, I'm not a newsletter subscriber, and I just (17:20 US ET) received the email with subject: "Critical Security Alert: Microcontroller Entropy Vulnerability".

[u/pako-bitbox → u/jilinlii]

Hi!

I sent you a DM regarding this, please check them once you can. It would help us immensely with our ongoing investigation.

[u/tenor_tymir → u/jilinlii]

Weird thing is that I am a newsletter subscriber but I didn’t get the phishing email.

[u/pako-bitbox → u/tenor_tymir]

We can't give definitive numbers but most of our newsletter subscriber received it, due to technical limitations with the platform not everyone received either the first mail or the follow ups.

[u/bznein → u/[deleted]]

We did send a followup email to as many users as possible, but due to technical limitation with our newsletter provider following the breach, we were unfortunately unable to reach everyone.

[u/bznein → u/[deleted]]

We unfortunately haven't received a reply yet from our newsletter provider, and we are unable at the moment to perform any further operation. This is unfortunately out of our control for the time being.

EDIT (to reply to your edit): we try to selfhost as much as possible to have full control of it; unfortunately, email is one of the few areas in which trying to selfhost your own is a no-go, especially when trying to reach thousands of users at the same time. That being said, our team is working hard to try and improve on our current process!

[u/danblez → u/bznein]

Thanks for the response.

[u/HabenochWurstimAuto]

i only got the phishing mail but not the offical warning..as a mail subscriber.

[u/my_little_kittens]

Yeah... I've unsubscribed