Crypto Wallet Buyers' Home Addresses Stolen in Shipping Company Breaches
Hackers broke into two shipping companies and stole the personal information of thousands of people who bought hardware cryptocurrency wallets, putting those customers at risk of scams and even physical attacks.
Trezor said on August 13, 2026 that nearly 14,000 of its customers had their names, home addresses, email addresses, and phone numbers stolen in a break-in at ShipMonk, the company Trezor uses to pack and ship its products. SafePal, another wallet maker, said it had a similar problem at one of its own shipping partners. The wallet makers had given customer details to these shipping companies so they could mail the physical devices. The hackers did not get into the wallets themselves or the secret codes stored on them. The breach was in the shipping system, not the wallet.
The distinction matters but offers limited comfort. The wallets are fine; the people who own them are now identifiable targets.
Here is why that is dangerous. A hardware wallet stores the secret recovery phrase that controls a person's cryptocurrency. If someone knows your name and address, and also knows you bought a crypto wallet, they can guess you probably own a significant amount of cryptocurrency. That combination has led to what the crypto world calls wrench attacks, where someone shows up at your door and forces you to hand over your recovery phrase. Blockchain security firm CertiK confirmed dozens of reported wrench attacks during 2025, a 75% increase over the previous year, with losses exceeding $40 million. Crypto forensics company Chainalysis placed 2026 wrench-attack losses at approximately $30 million so far, with attackers using kidnapping and home invasions to demand victims' recovery phrases directly.
Once an attacker gets a recovery phrase, the outcome is irreversible. The phrase gives full control of the wallet on the public blockchain, and transactions cannot be reversed, insured through regular banking protections, or recovered without the recipient's cooperation.
Trezor and SafePal both warned customers to watch out for phishing. With email addresses and phone numbers in hand, attackers can send targeted messages pretending to be the wallet makers, asking people to type their recovery phrase into a fake website. This is a familiar scam in crypto. In April 2018, MyEtherWallet suffered a DNS hijack that redirected users to a malicious server, resulting in losses for those who interacted with the fraudulent site.
The shipping breaches are not the only security problem hitting the hardware wallet world this month. In a separate attack earlier in August 2026, hackers stole more than $130 million in cryptocurrency from holders of Coinkite's Coldcard hardware wallets by exploiting a bug that let them predict the recovery phrases the devices generated. The wallets and their recovery phrases never touched the internet. The Financial Times reported that more than $100 million was stolen from Coldcard holders on July 30 after the bug led to private keys not being generated correctly. Bloomberg Crypto aired a segment titled "Bitcoin Wallet Hack Shakes Industry" on August 11, 2026.
The Coldcard incident is a different kind of problem from the shipping breaches. One is a flaw in how the wallet itself creates secret codes, which broke the core promise of an offline device. The other is an ordinary data breach at a shipping company that nonetheless creates a physical danger most crypto owners never expected.
The broader picture here is about how hardware wallets are sold. The whole idea of a hardware wallet is that your secret codes stay offline and under your control. But to sell and ship the device, the wallet maker has to pass your name, address, email, and phone number to a shipping company whose security the wallet maker does not control. The wallet itself is disconnected from the internet. The customer database is not.
This is not unique to crypto, of course. Anyone who has ever ordered a high-value item to their home address has created a similar, if lower-stakes, data trail. But the combination of a known crypto connection and a physical address creates a targeting list that a regular retail shipping record does not.
For context, the scale of crypto crime is large and growing. Cybercriminals stole $2.7 billion in crypto in 2025, with an additional $700,000 tracked as stolen from individual crypto wallets, according to data cited by TechCrunch. In June 2025, hackers stole at least $90 million from Iran's largest crypto exchange across multiple transactions, per blockchain analysis firm Elliptic. And in July 2026, an AI agent carried out the technical execution of a real-world ransomware attack for the first known time, though a human was still required for parts of the operation. The threat landscape spans protocol-level exploits, exchange break-ins, AI-assisted attacks, and now supply-chain-enabled physical coercion.
The wallet makers' advice to customers is simple: watch for phishing, never share your recovery phrase, and treat any unexpected message as suspicious. That is necessary but, given that home addresses were exposed, not enough to address the physical risk. Customers whose data was stolen in the ShipMonk breach face a danger that caution alone cannot fully solve. In my view, the industry will need to confront an uncomfortable reality: the most secure wallet in the world still arrives in a package with your name and address on it, and that label is only as safe as the shipping company holding it.
