Solana Mobile suspends email account after breach

TLDR

Solana Mobile has temporarily suspended its Brevo marketing email account after unauthorized access during a wider breach at the email provider.

1. Solana Mobile reports its Brevo account was accessed via a SAML SSO vulnerability and disabled, with no evidence so far that phishing emails were sent from its address.
2. The breach did not touch Solana (SOL) wallets directly, but it heightens phishing risk because attackers used legitimate email infrastructure that bypassed normal authentication checks.
3. Users should watch for Solana Mobile and Brevo follow-ups and treat any past or future Solana Mobile emails with caution, especially those asking for keys or recovery data.

Deep Dive

1. Breach Details And Solanas Response

According to a Solana Mobile statement, its third-party Brevo marketing email account was accessed during a broader breach at Brevo that exploited a SAML SSO vulnerability affecting 138 customers. The company says it identified unauthorized access to our Brevo account, disabled the account, and [is] working with Brevo to understand the scope of information accessed, and that there is currently no evidence any emails were sent from its account, though verification is ongoing. Brevo reports that six customer accounts were used to send phishing emails, contacts were exported from 43 accounts, and 93 accounts showed no meaningful activity, and notes that all malicious links have now been disabled in those emails, with the attackers access revoked, in its incident recap cited by Solana Mobiles update.

2. Phishing Risk For Crypto Users

Brevo confirms that the phishing messages sent from some compromised accounts went through legitimate infrastructure and passed usual email authentication checks, meaning they looked genuine to recipients. Even though Solana Mobiles account is not currently known to have sent such messages, this incident shows how vendor email compromises can be weaponized against crypto users without any on-chain breach. Other cases, such as Trezors hacked third-party email service that allowed phishing from its own domain, underline how attackers target the communication layer rather than wallets themselves, as noted in a recent weekly security review.

3. What To Watch Next

Solana Mobile is still working with Brevo to confirm what data, if any, was accessed or exported, and may publish further guidance if new risks are discovered. Brevo has acknowledged failing to protect customer trust in this incident and is likely to face ongoing scrutiny, especially as regulators push for faster incident reporting, such as the EUs Cyber Resilience Act rules that already force wallet manufacturers to disclose exploited flaws within tight deadlines. If investigations later show contacts tied to Solana Mobile were exported, users may see targeted phishing attempts using their names or email addresses.

Conclusion

Solana Mobiles suspension of its Brevo marketing email account is a defensive move during a third-party breach, not an on-chain hack of Solana itself. The real lesson for crypto users is that trusted-looking emails can be abused when vendors are compromised, so verification habits and strict protection of seed phrases and keys matter more than ever while investigations continue.