Trezor customer data exposed

[Ambatman]

I'm sorry but what's the essence of keeping customer data after delivery.
It seems it would be better to minimise unnecessary trust
And major stage in custody should be taken into our own hands.
Whether randomness or using a device with no access to the internet as an hardware wallet.
Because every additional party that possess something capable of compromising your
funds becomes another trust assumption.

[batang_bitcoin]

Anytime I see ledger is compared to Trezor, I don't look twice before I rushed to the thread to defend them with data breached but here is Trezor with 11k full personal data.

With users shipping addresses included in the data breach, I'm sure this version of scam that once targeted to Leger users will soon hit the affected users.

I thought of those, there will be mail scams coming to the victims but it's good approach that Trezor have informed them before they even come. It's just sad that there's no way for these potential scams and phishing to come to the victims but only to inform them beforehand. So the problem went not with Trezor but with its third party courier. I hope that they will roll out that anonymous courier soon for the sake of their customers privacy. And companies like shipmonk needs to lessen their data retention less than 90 days as soon as the shipment was done.

[standardnepo]

I got this email from Trezor. I ordered a cold wallet from them about two months ago, and I live in the UK.

Now I’m a bit worried about my physical address being leaked. I’ve read quite a lot about wrench attacks in France recently, and it’s made me worry about this more than I normally would.

Do you guys think the main risk here is just phishing emails and scams, or is this something I should genuinely be concerned about in terms of my family’s physical safety as well?

I have a 21-month-old daughter, so maybe my anxiety is making me overthink the situation a little.

[OmegaStarScream]

I got this email from Trezor. I ordered a cold wallet from them about two months ago, and I live in the UK.

Now I’m a bit worried about my physical address being leaked. I’ve read quite a lot about wrench attacks in France recently, and it’s made me worry about this more than I normally would.

Do you guys think the main risk here is just phishing emails and scams, or is this something I should genuinely be concerned about in terms of my family’s physical safety as well?

I have a 21-month-old daughter, so maybe my anxiety is making me overthink the situation a little.

It's impossible to know the intentions of whoever is going to buy those leaked info.

If relocation for sometime is not possible for you, you should consider adding a passphrase to your wallet, and keeping a decent sum in the main wallet. A decoy if god forbid you're forced to unlock the wallet.

Something else to consider would be good security for your house.

[Cookdata]

Anytime I see ledger is compared to Trezor, I don't look twice before I rushed to the thread to defend them with data breached but here is Trezor with 11k full personal data.

With users shipping addresses included in the data breach, I'm sure this version of scam that once targeted to Leger users will soon hit the affected users.

I thought of those, there will be mail scams coming to the victims but it's good approach that Trezor have informed them before they even come. It's just sad that there's no way for these potential scams and phishing to come to the victims but only to inform them beforehand. So the problem went not with Trezor but with its third party courier. I hope that they will roll out that anonymous courier soon for the sake of their customers privacy.

What about users with burner email, burner phone number but decided to use their real location for Trezor wallet delivery? You never can tell how worst the case might be for some people that will not get this notification, some people might give all details but fail to check their email for this update.

As dumb as this scam looks, there will be one or two victims that will fall for these incoming scams, if people can fall for fake apps, they can fall for phishing links, wallet update scams and seed phrase recovery.

With all these attacks on hardware wallet that the faults are from the companies, it's scary for me to trust any of these hardware wallet anymore to be super safe.

According to Trezor, they said it was their shipping providers that experienced a data breached, this might be true but unverifiable.

The best and most secured hardware wallet for my will be Electrum cold storage because you are the one to set up the wallet yourself and generate the private keys yourself with an airgapped device without sharing any of your data with anyone. Who knows which hardware wallet will be next.

Trezor is a hardware wallet not airgap but electrum on an airgap device and Trezor both are cold storage. Each have their advantages over other. If not for the data leak, Trezor is one of the best selling hardware wallet.

[5W-KILO]

Thankfully I searched for similar topic because I was about to create mine, right on time OP.

It's really not a great year for hardware wallet just like how CZ put this, only difference is he used month and not year, this is 2026 and whatever is happening right now will never be forgotten, 2026 is already marked.



Trezor did this one wrong, there is no need to keep data after a successful delivery of their devices, once the delivery is successful they should just wipe the data, this is also a way of keep decentralisation functional.

[standardnepo]

I got this email from Trezor. I ordered a cold wallet from them about two months ago, and I live in the UK.

Now I’m a bit worried about my physical address being leaked. I’ve read quite a lot about wrench attacks in France recently, and it’s made me worry about this more than I normally would.

Do you guys think the main risk here is just phishing emails and scams, or is this something I should genuinely be concerned about in terms of my family’s physical safety as well?

I have a 21-month-old daughter, so maybe my anxiety is making me overthink the situation a little.

It's impossible to know the intentions of whoever is going to buy those leaked info.

If relocation for sometime is not possible for you, you should consider adding a passphrase to your wallet, and keeping a decent sum in the main wallet. A decoy if god forbid you're forced to unlock the wallet.

Something else to consider would be good security for your house.

I’ve just saw this on their website.

Update: According to our newest findings, the 1,947 customers whose exposure was limited only to name, city and email address (without the shipping address) may include older orders. We are verifying this information and the timeframe with ShipMonk.

[Stalker22]

~
Trezor did this one wrong, there is no need to keep data after a successful delivery of their devices, once the delivery is successful they should just wipe the data, this is also a way of keep decentralisation functional.

A third-party shipping provider was actually responsible for the leak, not the manufacturer itself.  So I would not put the blame entirely on the Trezor.  And yes, they may have handled it better and may very well do so next time - but that is not a guarantee that a situation like this wont happen again.

[promise444c5]

Finally, something the other parties can boast about since we won’t stop praising Trezor for doing such a great job in convincing people that they are  the best.

Still the best hardware wallet anyway..

I got this email from Trezor. I ordered a cold wallet from them about two months ago, and I live in the…

Now I’m a bit worried about my physical address being leaked. I’ve read quite a lot about wrench attacks in France recently, and it’s made me worry about this more than I normally would.

Do you guys think the main risk here is just phishing emails and scams, or is this something I should genuinely be concerned about in terms of my family’s physical safety as well?

I have a….., so maybe my anxiety is making me overthink the situation a little.

Don’t be too worried though..unless they run background check and found some information about you that could give them assurance of getting something worth the effort from you, they won’t risk that much on wrench attacks but it’s possible.  

What they will most likely do with this info is social engineering and attempts to phish or scam you directly but there’re some possibility it get to the hands of crazy individuals who can go to the extent of attacking their victim physically  

You should try doing what OmegaStarScream mentioned though, it could help you.

BTW, you’re giving away so much in your post already   

[dkbit98]

I don't want to sound like a broken record, but I warned people so many times to buy their hardware wallets locally, whenever that is possible.
Most hardware wallet manufacturers are working with third party services, and that increase risk a lot of exposing customer information.
I have to criticize Terzor againb, and I think they should create better way of keeping personal information more secure.
For start they should create more physical shops, and not force people to buy everything online.

[Mate2237]

With all these attacks on hardware wallet that the faults are from the companies, it's scary for me to trust any of these hardware wallet anymore to be super safe.

The best and most secured hardware wallet for my will be Electrum cold storage because you are the one to set up the wallet yourself and generate the private keys yourself with an airgapped device without sharing any of your data with anyone. Who knows which hardware wallet will be next.

The target now is for the hardware wallets and from ColdCard case, users were scared to use hardware wallets and Trezor now is compromised so all these are making people to be scared the more and before they are attacking hardware wallets lime this, they must have been trying to attack software Wallets but they could not penetrate because for security protocols and that is why the target now is on the hardware wallets.

There are three Wallets that are security tight now. Electrum,  Bluewallet and Bitcoin Core Inbuilt wallet are the ones to secure our bitcoins now. But we still have to know that this has nothing to do with the future of bitcoin. This is not an attacks on the bitcoin network to divert transaction but an attacks on a particular wallets. Therefore everyone should calm down to observe what is happening and always be vigilant to watch.

[batang_bitcoin]

I thought of those, there will be mail scams coming to the victims but it's good approach that Trezor have informed them before they even come. It's just sad that there's no way for these potential scams and phishing to come to the victims but only to inform them beforehand. So the problem went not with Trezor but with its third party courier. I hope that they will roll out that anonymous courier soon for the sake of their customers privacy.

What about users with burner email, burner phone number but decided to use their real location for Trezor wallet delivery? You never can tell how worst the case might be for some people that will not get this notification, some people might give all details but fail to check their email for this update.

As dumb as this scam looks, there will be one or two victims that will fall for these incoming scams, if people can fall for fake apps, they can fall for phishing links, wallet update scams and seed phrase recovery.

That's a real problem in there if they don't read the notification and updates about this data leak that has happened. That is why being informed is a weapon against these scams and much worse if someone takes it personally or their location is sold by these hackers and, bought by criminals and goes into the location of these users because they know that they're into holding and plans to harm them physically just as a $5 wrench attack which I hope that none of it will happen. But with how cruel these criminals are and willing to go for extra mile, we can only hope for their safety.

[rdluffy]

I don't want to sound like a broken record, but I warned people so many times to buy their hardware wallets locally, whenever that is possible.
Most hardware wallet manufacturers are working with third party services, and that increase risk a lot of exposing customer information.
I have to criticize Terzor againb, and I think they should create better way of keeping personal information more secure.
For start they should create more physical shops, and not force people to buy everything online.

It’s a really tough situation
I live in Brazil, and there aren’t any physical stores here that sell hardware wallets, you can only buy them online

If there’s a malicious seller or a problem with the retailer, hardware wallet users will be at risk

The only way I was able to buy my Trezor was when I traveled to the United States, bought it on Amazon, and picked it up from a locker
It was the cheapest and safest way I found to buy one

Fortunately, I’m not in Trezor’s database

[sergiorus]

~
Trezor did this one wrong, there is no need to keep data after a successful delivery of their devices, once the delivery is successful they should just wipe the data, this is also a way of keep decentralisation functional.

A third-party shipping provider was actually responsible for the leak, not the manufacturer itself.  So I would not put the blame entirely on the Trezor.  And yes, they may have handled it better and may very well do so next time - but that is not a guarantee that a situation like this wont happen again.

They could and they should have.

There are delivery services that treat stuff like this extremely seriously and they are used for delivering of goods requiring the highest level of confidentiality.

If devices made for holding potentially millions and millions dollars of funds aren't ones, then I don't know what to say...

[Italian Panic]

It’s been a summer of problems with self-custody; the data that’s been stolen is extremely valuable. Some people might well find themselves receiving visits at home, given that those who use a hardware wallet don’t do so for a few satoshis or 10k dollar worth of Bitcoin.

This is the result of relying on third parties, and on a third party that in turn relies on yet another third party.

Meanwhile, requests for this data are starting to circulate on the dark web, accompanied by attractive offers.

[PX-Z]

This is probably one of the worst things that can happen to hardware wallet users. Regardless of how secure the device itself is or how much effort the company puts into securing its products, users can still end up being bombarded with phishing emails and messages because of a third-party partner's security failure or incompetence.

Even if the incident is limited to users in certain countries, it is still a major headache. The hardware wallet itself may remain secure, but compromising user information creates an entirely different attack surface. It gives attackers more opportunities to target users with convincing phishing attempts, social engineering, and other scams.

[ColdLava40]

Someone can now call Trezor users and threaten him. What if it lead to wrench attack? It is very possible.

It will, it most likely will. I still think there should be better ways of delivering these hardware wallets to customers without taking their data.

If hardware wallets are supposed to keep not just your coins but privacy, then requesting user personal data, email, Address should not be done. We still have many functional post office. buyers could pick one closest to them and choose to pick up their packages.

If further confirmations will be prompted, then a unique Id or something of that nature should be attached to every products and only the buyer would have this which they will provide on pickup.

[Synchronice]

Brutal month for hardware wallet industry...

Imagine losing everything you held on your Coldcard, then going to reserach the safest hardware wallet options, discovering and ordering Trezor just to have your info leaked a few days afterwards...

That's why probably it's better to buy a cheap used laptop, remove Bluetooth and Wi-Fi, never connect it to the internet ever, install a tails on a flash drive, put it on your computer and then generate a seed for your Bitcoin wallet. Everyone buys laptops, so even if the fact that you bought a laptop gets leaked, it's not a problem and you won't become a victim of scammers or an attack.

By the way, I'm a little bit shocked that they didn't thought about how to make delivering their hardware wallet more anonymous because it's very simply. You put your random ID, they partner with DHL or another company where courier puts it in a locker and then you take your package at any time anonymously. Anonymous international deliveries will definitely be impossible.

[sergiorus]

Brutal month for hardware wallet industry...

Imagine losing everything you held on your Coldcard, then going to reserach the safest hardware wallet options, discovering and ordering Trezor just to have your info leaked a few days afterwards...

That's why probably it's better to buy a cheap used laptop, remove Bluetooth and Wi-Fi, never connect it to the internet ever, install a tails on a flash drive, put it on your computer and then generate a seed for your Bitcoin wallet. Everyone buys laptops, so even if the fact that you bought a laptop gets leaked, it's not a problem and you won't become a victim of scammers or an attack.

...OR you can just order a Trezor on another address using fake name?

Trezor is the real deal, I just love it. Incredibly convenient to use and it's been proven to have the most secure entropy.

Again, it's not entirely the company's fault (although as I already said they should have handled it better by using confidential-first delivery services, even if they are more expensive) and one could avoid it if with just a little more effort.

Again, that effort would be nowhere close to the laptop hassle you described.

[Stalker22]

~
By the way, I'm a little bit shocked that they didn't thought about how to make delivering their hardware wallet more anonymous because it's very simply. You put your random ID, they partner with DHL or another company where courier puts it in a locker and then you take your package at any time anonymously. Anonymous international deliveries will definitely be impossible.

Well, this sounds simple in theory, but I dont think its possible in the real world.  Trezor (operated by parent company SatoshiLabs) is headquartered in Prague, Czech Republic.  DHL and all major couriers in EU are legally bound by strict KYC and anti-money laundering regulations which require real recipient details - especially for international shipping.