Shipping partner breaches expose hardware wallet owners to new risks
Data breaches at shipping partners used by hardware wallet makers Trezor and SafePal have exposed the personal and delivery details of thousands of cryptocurrency customers. The affected information included names, home addresses, email addresses and phone numbers supplied to fulfil orders for physical wallets.
Neither company said the incidents compromised the security of the hardware wallets themselves. These devices keep private signing operations offline, making direct remote compromise more difficult. The breaches instead show how customer exposure can arise through external suppliers that handle data around a wallet purchase.
Delivery data can enable physical targeting
For criminals, an address linked to a hardware wallet may identify a potential crypto holder and create opportunities for targeted phishing or in-person coercion. An attacker who obtains a victim’s seed phrase can take control of the associated cryptocurrency on the public blockchain, with transfers generally irreversible.
Such incidents are often described as wrench attacks: real-world robberies, home invasions or kidnappings intended to force a victim to reveal a recovery phrase. CertiK confirmed dozens of reported wrench attacks during 2025, a 75% increase from the prior year, with robbers stealing more than $40 million. Chainalysis put the total stolen so far this year closer to $30 million.
Offline storage does not remove supply-chain exposure
Trezor and SafePal warned affected customers to remain alert to phishing messages directed at exposed phone numbers or email accounts. A convincing message can exploit knowledge that someone bought a wallet, even when the device and its seed phrase have never been online.
The report also cited a separate attack involving Coinkite’s Coldcard wallet, in which hackers stole more than $130 million in cryptocurrency. The attackers allegedly predicted seed phrases generated offline because of a vulnerability in code dating to 2021, allowing them to generate wallet passwords and take funds directly from the blockchain.
Security planning must include personal information
The cases distinguish device security from the security of the broader purchase and custody process. Hardware isolation remains valuable, but fulfilment records, contact details and recovery-phrase handling can each become an attack path.
For businesses and individuals holding crypto, the practical implication is to treat delivery and identity data as security-sensitive, verify unsolicited wallet-related communications independently, and ensure seed phrases remain protected from both digital theft and physical coercion.