Nordstrom's genuine marketing email system used to send "double your crypto" scam emails
Nordstrom's real marketing email address was used to send a fake St Patrick's Day offer to double crypto sent to a wallet. Wallets took over US$5,600. Nordstrom disowned the emails. Delete any such message and never send crypto to a retailer.
Delete any email offering to double crypto, even from a real-looking retailer address, and never send cryptocurrency to a shop. If you sent funds, report it to your local fraud-reporting service and your exchange straight away, though recovery is unlikely.
What’s happening
On 18 March 2026, Nordstrom customers received emails from the retailer's genuine marketing address promising to double any cryptocurrency sent to a listed wallet within two hours, as a St Patrick's Day promotion. Because the messages came from a real Nordstrom address, they would not look like ordinary spam. Nordstrom soon sent a follow-up calling the first message unauthorised, telling customers to ignore it, saying it never asks customers to pay in cryptocurrency, and saying it was investigating. BleepingComputer reported the wallets had received a little over US$5,600. StoneTurn said the funds were spread across three wallets and that crypto payments cannot be reversed, which makes recovery hard. A source told BleepingComputer the cause was an Okta single sign-on to Salesforce compromise, with emails sent through Salesforce Marketing Cloud, but this is unconfirmed and Nordstrom did not comment on it. We found no later reporting on the investigation's outcome, recovered money, arrests or charges, and it is not known how many customers received the emails.
- What
- Scam
- Affects
- Nordstrom customer marketing emails
- Fixed in
- Nothing to patch
- Since
- 18 Mar 2026
- Closed
- 19 Mar 2026
Timeline
- UpdateNothing to patch
Investigations firm StoneTurn said the offer was split across three wallets and that Nordstrom's warning, sent within a couple of hours, likely limited further losses. It noted that crypto payments are irreversible and that people who paid before the warning were harmed.
- UpdateNothing to patch
BleepingComputer's source described the cause as an Okta single sign-on to Salesforce compromise, with the emails sent via Salesforce Marketing Cloud. BleepingComputer could not confirm this, and Nordstrom did not respond to its request for comment.
- UpdateNothing to patch
Nordstrom sent a follow-up email calling the earlier message unauthorised, telling customers to ignore it, saying it never asks customers to pay in cryptocurrency, and saying it was investigating. The scam wallets had received a little over US$5,600 by then.
- Made publicNothing to patch
Nordstrom customers received emails from the retailer's genuine marketing address ([email protected]) promising to double any cryptocurrency sent to a wallet within two hours as a St Patrick's Day promotion. The company name was misspelled "Normstorm" in the message.
Sources
- Nordstrom's email system abused to send crypto scams to customersBleepingComputer · 18 Mar 2026
- When the Email Looks Real but the Offer Isn't: Recognizing Cryptocurrency ScamsStoneTurn · 19 Mar 2026