Shipping Data Breaches at Trezor and SafePal Expose Hardware Wallet Owners to Physical and Phishing Threats
Data breaches at two third-party shipping providers have exposed the personal information of thousands of hardware cryptocurrency wallet customers, putting them at heightened risk of phishing campaigns and physical attacks aimed at stealing their seed phrases.
Trezor disclosed on August 13, 2026 that nearly 14,000 of its customers had their names, home addresses, email addresses, and phone numbers exposed in a breach at ShipMonk, its third-party fulfillment partner. SafePal reported a separate but similar breach at one of its own shipping partners. The wallet makers had provided customer details to these logistics companies for mailing physical hardware devices. Neither breach compromised the hardware wallets themselves or their on-device cryptographic material. The attack surface was the supply chain, not the secure element.
The distinction matters but offers limited comfort. The wallets are fine; the people who own them are now identifiable targets.
By pairing stolen names and home addresses with the knowledge that these individuals purchased hardware wallets, attackers have a curated list of likely high-net-worth crypto holders and where they live. That combination enables what the industry calls wrench attacks, named for the cartoonish extremity of physically coercing someone into surrendering their seed phrase. Blockchain security firm CertiK confirmed dozens of reported wrench attacks during 2025, a 75% increase over the previous year, with losses exceeding $40 million. Crypto forensics company Chainalysis placed 2026 wrench-attack losses at approximately $30 million so far, with attackers employing kidnapping and home invasions to demand victims' seed phrases directly.
Once an attacker obtains a seed phrase, the outcome is irreversible. The phrase grants full control of the associated wallet on the public blockchain, and transactions cannot be reversed, insured through conventional banking mechanisms, or recovered without the recipient's cooperation.
Trezor and SafePal both warned customers to remain vigilant against phishing, the more scalable threat vector. With email addresses and phone numbers in hand, attackers can craft targeted messages impersonating the wallet makers, urging recipients to enter their seed phrase on a spoofed recovery page. This is a well-established attack pattern in the crypto space. In April 2018, MyEtherWallet suffered a DNS hijack that redirected users to a malicious server, resulting in losses for those who interacted with the fraudulent site.
The shipping breaches are not the only security event hitting the hardware wallet ecosystem this month. In a separate attack earlier in August 2026, hackers stole more than $130 million in cryptocurrency from holders of Coinkite's Coldcard hardware wallets by exploiting a bug that allowed them to predict the seed phrases the devices generated offline. The wallets and their seed phrases never touched the internet. The Financial Times reported that more than $100 million was stolen from Coldcard holders on July 30 after the bug led to private keys not being generated correctly. Bloomberg Crypto aired a segment titled "Bitcoin Wallet Hack Shakes Industry" on August 11, 2026.
The Coldcard incident is a category apart from the shipping breaches. One is a cryptographic implementation failure that defeated the core security promise of an offline device. The other is a conventional data breach at a logistics vendor that nonetheless produces a physical threat model most crypto holders never planned for.
Looking at what this means for the hardware wallet model, the supply-chain exposure reveals a structural tension. The security architecture of a hardware wallet assumes the device itself is the trust boundary: keys are generated and stored offline, transactions are signed on-device, and the seed phrase never leaves the owner's physical control. But the business of selling and shipping those devices requires entrusting a name, address, email, and phone number to a fulfillment company whose security posture the wallet maker does not control and whose customer base extends far beyond crypto. The hardware is air-gapped. The customer database is not.
This is not unique to crypto, of course. Anyone who has ever ordered a high-value item to their home address has created a similar, if lower-stakes, data trail. But the combination of a known crypto affiliation and a physical address creates a targeting dataset that a generic retail shipping record does not.
Worth flagging: the aggregate loss figures for crypto crime in 2025 provide context for the stakes. Cybercriminals stole $2.7 billion in crypto in 2025, with an additional $700,000 tracked as stolen from individual crypto wallets, according to data cited by TechCrunch. In June 2025, hackers stole at least $90 million from Iran's largest crypto exchange across multiple transactions, per blockchain analysis firm Elliptic. And in July 2026, an AI agent carried out the technical execution of a real-world ransomware attack for the first known time, though a human was still required for parts of the operation. The threat landscape spans protocol-level exploits, exchange compromises, AI-assisted attacks, and now supply-chain-enabled physical coercion.
The wallet makers' guidance to customers is straightforward: be alert to phishing, do not share seed phrases, and treat any unsolicited communication as suspicious. That is necessary but, given the home-address exposure, not sufficient to address the physical risk. Customers whose data was exposed in the ShipMonk breach face a threat model that customer-side vigilance alone cannot fully mitigate.
