Breaches at shipping partners exposed names, addresses, emails and phone numbers for customers of Trezor and SafePal. The leaks increase the threat of violent “wrench attacks” and targeted phishing, even though the devices themselves were not remotely compromised.
Exposed personal data raises risk of physical attacks (wrench attacks) and targeted phishing, despite wallets remaining offline.
Separate incident: Coldcard/Coinkite wallets lost more than $130 million after attackers exploited a seed-generation/password vulnerability.
Customers should assume greater physical and phishing risk and take concrete steps to reduce exposure.
# What happened
The breaches did not compromise the wallets' offline cryptographic security. The devices remain designed to operate offline so they are harder to attack remotely. The problem is the supply chain: attackers targeted the vendors that handled shipping and customer data to learn where high-value crypto holders live.
# Why this matters now With names and home addresses in hand, criminals can mount real-world attacks aimed at forcing victims to reveal their seed phrases. These so-called wrench attacks use threats, kidnapping or home invasion to extract the secret recovery phrase that gives attackers irreversible access to funds on the public blockchain.
Security firms have reported an uptick in these kinds of incidents. CertiK confirmed dozens of reported wrench attacks in 2025 and recorded a 75% year-over-year increase, with robbers stealing upwards of $40 million. Chainalysis reported around $30 million stolen so far this year, including robberies where kidnappings and invasions were used to coerce victims into surrendering seed phrases.
# How attackers are likely to act
# Practical steps for affected customers
# What to watch next
# Bottom line The immediate cryptographic security of most hardware wallets wasn't broken by these shipping-company leaks. The practical risk has risen because attackers can now link people to addresses and contact details, enabling violent coercion and highly targeted phishing. Wallet owners should assume increased risk and take concrete steps to reduce exposure and verify communications.
Three hardware wallet and broker breaches in a single week exposed 253,487 customers. The common thread is not the companies themselves but the third party vendors they trusted with physical addresses, and a single Metabase zero day that connected two of the three incidents.
Owners of Trezor and SafePal crypto wallets at high risk of phishing attempts after separate data leaks, CLARITY odds at 10% despite White House meeting this week.
Another day, another security alert. Hardware wallet manufacturer Trezor says a breach involving shipping partner Shipmonk exposed the personal information of roughly 67,000 additional U.S. customers after records that Trezor says should have been deleted instead remained tucked away in the vendor’s systems. The newly
ShipMonk breach exposed names, addresses, and phone numbers of 13,689 customers, raising fraud risk for Trezor users. Continue reading at DailyCoin.
Security expert Nick Neuman warned that leaked home addresses could enable criminals to more easily target people for wrench attacks.
The newest worker on your team builds with whatever it finds and never asks what deserves your trust. Our answer is a hardened foundation and a boundary built for agents.
Loading more related stories...
Open the app view to save this story, compare related coverage, and continue from the same source.