If you received an email titled “Data Breach Notice: Please refresh API Keys as soon as possible”, that email was not sent by CoinTracking. It is a phishing attempt.
Your CoinTracking account is not affected
The email was sent through an external email service provider that we use to deliver messages. The incident was limited to that service – not to CoinTracking's own systems.
That service holds no passwords, no API keys and no portfolio or transaction data. Your account, your login details and your connected exchanges remain secure.
Based on current information, email addresses held by that provider may have been accessed during the incident. In practice this mainly means: please be especially attentive over the coming weeks to emails that appear to come from us.
What you should do
For the vast majority of recipients, no action is needed. If the email is still in your inbox:
- Do not click any links in it.
- Do not enter your CoinTracking login details or API keys on any page it links to.
- Delete the email.
If you already entered information
Only in that case are two steps worth taking:
- Change your CoinTracking password and enable two-factor authentication if you have not already.
- If you entered exchange API keys, revoke and regenerate them directly at the exchange that issued them – never through a link in an email.
Current status
The access route used to send these emails has been closed, and the links contained in the messages have been deactivated. We have reviewed our own systems and found no indication of any access.
Our email service provider, Brevo, has documented the incident in a public statement.
CoinTracking is certified under ISO 27001 for information security. If you have any questions, you can reach us any time at support@cointracking.info.
Last updated: 11 September 2026
