BitBox email subscriber list leaked through a compromised mailing service and used for phishing asking for recovery words
On September 10, 2026, attackers exploited a vulnerability in a third-party mailing service, gained access to the Shift Crypto / BitBox account, exported the entire contact list and used the account to send two phishing campaigns. The emails used legitimate mailing infrastructure and passed standard authenticity checks, so they looked like the official newsletter: they falsely claimed there was a vulnerability in BitBox and asked recipients to enter their recovery words on a website. Only the email addresses of subscribers to the newsletter, educational emails and affiliate program were leaked; according to the vendor, order data, internal systems, the app and the devices themselves were unaffected. The risk is direct: an address from a list of hardware wallet owners is a ready target for seed-focused phishing.
Treat any email in the vendor's name asking you to enter recovery words as phishing and delete it, both now and in the coming weeks when further waves arrive. Enter recovery words only on the device itself when restoring a wallet: never on a website, in an app, in an email reply or in a support ticket. If you have already entered recovery words on a phishing site, treat the seed as compromised, immediately contact the vendor's support (without sending the seed itself) and transfer funds to a wallet with a newly generated seed. If you subscribed to the mailing list using a temporary email alias, delete it and subscribe again with a fresh one.