Crypto hardware wallet owners face fresh security risks after recent spate of personal data thefts

Data breaches at two shipping companies has put cryptocurrency owners with physical hardware wallets at greater risk of having their funds stolen, highlighting weaknesses in the broader tech ecosystem relied on by the crypto industry.

In recent weeks, makers of hardware crypto wallets Trezor and SafePal reported that collectively thousands of their customers had their personal data and shipping information stolen during separate data breaches at their shipping partners. The crypto wallet makers provided their customers’ names, home addresses, email addresses, and phone numbers to the shipping companies for mailing out their hardware wallets.

The hacks did not affect the security of the wallets, a hardware device that stays offline that makes it far more difficult for hackers to compromise from over the internet. Instead the hackers targeted the broader supply chain of tech companies to obtain personal information about where high-net worth crypto holders live. 

By stealing the names and home addresses of hardware wallet customers, the hacks expose crypto owners to physical attacks that rely on physically obtaining the seed phrase stored on the wallet by force or violence. 

Known as wrench attacks (referring to the use of weapons), these kinds of real-world attacks are on the rise as criminals increasingly seek out crypto belonging to high-net individuals. Blockchain security company CertiK confirmed dozens of reported wrench attacks during 2025, up by 75% on the previous year, with robbers stealing upwards of $40 million. Crypto forensics giant Chainalysis puts this year’s figures at closer to $30 million so far, with gangs using kidnapping and home invasions to demand a person’s crypto seed phrase.

With knowledge of a person’s seed phrase, the attackers can irreversibly take control of the person’s crypto on the public blockchain.

Both Trezor and SafePal also warned customers to stay vigilant against phishing attacks, which rely on sending targeted messages to a person’s phone number or email address in an attempt to steal their crypto.

In a separate attack on a hardware wallet earlier this month, hackers stole more than $130 million in cryptocurrency directly off the blockchain by guessing the passwords set by Coinkite’s Coldcard hardware wallet. 

The hackers, who have not yet been identified, were able to predict the seed phrases that Coldcard wallets would generate offline for their customers. Even though the wallets and seed phrases never touched the internet, the hackers were able to generate customer wallet passwords on the fly and pluck their funds directly off of the blockchain.

One victim said in a post on X that they had done “everything right,” but that “none of it mattered… all because the hardware that created the seed phrase originally had one line in their code from 2021 that had a vulnerability.”