A data breach at hardware wallet maker Trezor’s logistics partner has exposed personal information for roughly 13,700 recent customers, drawing warnings from Binance founder Changpeng Zhao and security experts about phishing, social engineering, and even physical attacks against crypto holders.
Trezor said ShipMonk, its shipping services provider, notified the company on Monday, August 10, about unauthorized access to systems holding customer order data. The company disclosed the incident on August 13, confirming that approximately 11,700 users had names, email addresses, phone numbers, and delivery addresses exposed. No Trezor wallet infrastructure or user private keys were compromised, but CZ stressed that linking identity and physical address data to cryptocurrency ownership creates a distinct and serious risk profile.
CZ responded Thursday by arguing the breach underscores a practical advantage of software self-custody wallets. “Hardware wallets are often considered ‘more secure’ than software wallets,” he wrote. “While I still think that is ‘generally true’ in a few specific aspects, this incident reinforces an advantage of software self-custody wallets.” He cited Binance Web3 Wallet and Trust Wallet as examples that do not require shipping a physical device tying a buyer’s identity and home address to crypto ownership. He added, “Not saying hardware wallets are ‘bad.’ Just different profiles,” and noted that YZiLabs is an investor in many hardware wallet companies.
Security voices amplified the concern. NaoX Protocol said the exposed addresses could give attackers a list of verified crypto holders worth targeting in person, while Bitcoin security executive Nick Neuman warned of targeted social engineering and potential wrench attacks. Trezor advised affected users to be especially wary of fake emails, phone calls, and letters, and never to enter wallet backups online or share them with anyone.
The breach adds to a difficult period for hardware wallet makers. In mid-July, on-chain investigator ZachXBT called all hardware wallets “complete garbage,” and last week Galaxy Research linked more than $100 million in stolen Bitcoin to older Coldcard firmware that generated wallet seeds with weaker randomness. Coinkite has patched newer releases but cannot fix seeds already generated on affected devices and has told holders of Mk3 through Q models to move funds to unaffected hardware. Trezor also suffered a separate third-party vendor breach in January 2024 that exposed contact details for around 66,000 users.
