Trezor is a very good wallet, and I can recommend it, but the probelm that I have with these hardware companies is how they are dealing with customers data. Buying the wallet directly from the company can mean not having privacy.

If home addresses of people are known to the bad people, sending phishing letters to them will be common. Also phishing emails will be common.

Someone can now call Trezor users and threaten him. What if it lead to wrench attack? It is very possible.

Wrench attack is on the rise in some countries.

Trezor is shipping to 196 countries. That is almost all countries in the world.

Since it’s a hardware wallet, you’d expect better privacy and security.. Therefore, the leak of data from more than 13K customers is a serious problem.

I think the anonymous delivery coming in September could help avoid something like this from happening again. This could be a good option instead of relying on Trezor’s shipping partners, especially after what happened with ShipMonk.

They could also make the shipping partners follow a stricter policy, like anonymizing customer and order details just a few days after delivery instead of keeping it that long.

Honestly, it’s not just about phishing emails. This information could also be used for targeted phone calls, texts, blackmail, or threats.

A wrench attack is very possible in this case. With the amount of personal information that has been breached, it is enough for a physical coercion with the user which in some countries it is actually on the rise. The good news is that their seed phrase and private keys are safe and no one will have access to their wallet with this information unless they fall for phishing emails, SMS or calls.

With the quick response from Trezor to contact all affected users through a separate email, it shows how concerned they are and taking quick action to minimize any possible retaliation to their customers through the breach. The amount of personal information required from this self custody is much, it should be minimized. Hopefully with this breach, they can fast track their plan to introduce anonymous delivery intended for September 2026.


This fast action taken by Trezor should suffice unless any of the user’s didn’t get to receive a mail about it or miss checking their mail box earlier about it. Any form of call, SMS, or phishing email directing an action to their Trezor wallet should already signify a red flag to them. They should not act in fear to such attempt by scammers, the main thought of concern is the wrench attack of users already breached of their personal information.

No matter how safe your keys are, you're likely to give out when you're attacked. The attackers are usually merciless and you'll have to choose between your life or the keys. I'm not a seer but I can tell what your choice would be in such situation. The best they can do is to review personal details information needed for delivery and make it secretly as possible.


I respect their transparency tbh. They can conceal the incident and pretend like nothing happen but they choose to make it public, offer apology and reveal how they are working to minimise the future occurrence.

Regardless, if we keep having incidents like this with hardware wallets, people might begin to lose interest in using them.

That should sell pretty good on the dark web.

The most anonymous way to purchase a hardware wallet is to build it yourself, unfortunately. SeedSigner is a signing device that has plenty of material to watch and do it your own, it is not too technical. But in general, I have come to the conclusion that using an airgapped laptop with Linux, and you use it just to sign transactions, probably beats most of the hardware wallets.

Brutal month for hardware wallet industry...

Imagine losing everything you held on your Coldcard, then going to reserach the safest hardware wallet options, discovering and ordering Trezor just to have your info leaked a few days afterwards...

That's not funny, of course. My heard, once again, goes to everyone affected. However, that's just another reminder that every time you fill in your address and other data somewhere on the internet, there is always a chance it will be leaked.

Anytime I see ledger is compared to Trezor, I don't look twice before I rushed to the thread to defend them with data breached but here is Trezor with 11k full personal data.

With users shipping addresses included in the data breach, I'm sure this version of scam that once targeted to Leger users will soon hit the affected users.

Perfect timing. It's a continuous attack to self-custody or maybe yes, this provider has been just unlucky and lost this data ?
I am surprised to see also that TREZOR has provided such numbers of their business available to competitors - it could allow to estimate some data about sales total revenue... it's an useless transparency. This number doesn't help at all...
I am interesting to see this solution/uptade since they would have to handle shipping in the EU with new regulation about packaging recycling that involves registration in a single country (each of EEA)...

With all these attacks on hardware wallet that the faults are from the companies, it's scary for me to trust any of these hardware wallet anymore to be super safe.

The best and most secured hardware wallet for my will be Electrum cold storage because you are the one to set up the wallet yourself and generate the private keys yourself with an airgapped device without sharing any of your data with anyone. Who knows which hardware wallet will be next.