Our preliminary review of the phishing mail that was sent out to our newsletter subscribers about an hour ago found that it is very likely that our newsletter provider got compromised.
Multiple other Bitcoin companies got targeted as well, and it appears that we all share the same newsletter provider.
We sent out a phishing warning to all our newsletter subscribers, contacted the provider and reported the phishing domains. Most of the phishing links appear to have been taken down already.
We are still actively investigating this situation and will update you once we know more.
BitBox
npub1tg…3cxmt
2026-09-09 21:07:39 UTC
Author Public Key
npub1tg779rlap8t4qm8lpgn89k7mr7pkxpaulupp0nq5faywr8h28llsj3cxmtSeen on
wss://nos.lolPublished at
2026-09-09 21:07:39 UTCEvent JSON
{
"id": "8d4795cd7c1a4cd529bbfe66b4bb971c7e515db9304318b6a437c92bbd1b47bf",
"pubkey": "5a3de28ffd09d7506cff0a2672dbdb1f836307bcff0217cc144f48e19eea3fff",
"created_at": 1788988059,
"kind": 1,
"tags": [
[
"client",
"Damus"
]
],
"content": "Our preliminary review of the phishing mail that was sent out to our newsletter subscribers about an hour ago found that it is very likely that our newsletter provider got compromised.\n\nMultiple other Bitcoin companies got targeted as well, and it appears that we all share the same newsletter provider.\n\nWe sent out a phishing warning to all our newsletter subscribers, contacted the provider and reported the phishing domains. Most of the phishing links appear to have been taken down already. \n\nWe are still actively investigating this situation and will update you once we know more.",
"sig": "254a274829463ddd2f4cb041f33c1f6047e1f71c95a7bc7beeef5a2dffcf5e962562e235154c4382e17de759aca19caefeac9e27de42696aac40e9b76017ac26"
}