Couriers have data of every hardware wallet purchased and delivered successfully

[KiaKia]

Lately I've been thinking, is it really safe that couriers are the ones shipping hardware wallet that we purchased from official hardware wallet companies to our homes?

Since Bitcoin and crypto are the new gold mine if eventually Bitcoin goes up to $1 million dollars per coin this will make bad actors to even want to commit more crimes just to secure people's Bitcoin.

My worries is couriers or what are they called have your address and they know what you are buying since the receipt sometimes comes with the item glued to the case or package.

Call me crazy but I am just thinking ahead.

Wouldn't it be better for hardware wallet companies to handle shipping themselves and they will be able to erase data after delivery becomes a success? People who bought hardware wallet shouldn't be known by anybody.

[Upgrade00]

There is a recent thread about a data breach from the shipping service that leaked thousands of personal information of trezor wallet buyers. This is just one of the dangers of having multiple parties involved in the purchase of a wallet besides the one you pointed out of a bad actor acting alone later targeting crypto holders.

They play to roll out anonymous shipping in a couple of months to help curb the risk.

[Zaguru12]

Yeah the use of this third party shipping delivery or logistics is probably one of the most common means that the leads to the ever growing case of wrench attacks. Hardware wallets can actually try to ship it themselves if there is possibility but yet something like what happen with Trezor will actually not stop as long as they keep buyers details even for a day.

Regardless of any shipping means I think the established fact is that when ordering hardware wallets one should actually get use to using burner details. From using;

PO BOX  as there are many hardware wallets that supports shipping to hardware wallets: hardware wallets that supports shipping to PO Box

Using crypto (bitcoin) as means of payment

Using burner email address and phone number,

this gets you at least a better deal of not leading the courier or company direct to you or your house

[Charles-Tim]

If you want privacy, no need to buy a hardware wallet. You can set up your own hardware wallet by setting up an airgapped device and install a wallet like Electrum on it. This is my best solution. I do not like the situation that someone will know that you bought a hardware wallet.

I am not implying that the hardware wallets that are open source and reputed are not good, but people should know the privacy deprivation that may happen while buying one.

[Aanuoluwatofunmi]

Wouldn't it be better for hardware wallet companies to handle shipping themselves and they will be able to erase data after delivery becomes a success? People who bought hardware wallet shouldn't be known by anybody.

What if the hardware wallet companies decided to handle this entire shipping of the wallet to their various customers across the world I yet there is no safety with the information provided to them for delivery, you cannot predict anything that could happen as long as there is a personal information involved that is traceable to individuals identity, except if they will only deliver to each country by a unique code that we have to come within wallet purchase without users filling for kyc.

[Charles-Tim]

What if the hardware wallet companies decided to handle this entire shipping of the wallet to their various customers across the world I yet there is no safety with the information provided to them for delivery, you cannot predict anything that could happen as long as there is a personal information involved that is traceable to individuals identity, except if they will only deliver to each country by a unique code that we have to come within wallet purchase without users filling for kyc.

If you are working with a company, you can use the companies address. If POX is possible, sending it to post office can also be better, but I prefer the address of where someone is working which I think is the safest among the options.

The problem is most people do not know all these, they will use their home address.

A code can not be used because some information of how the person will collect the hardware wallet have to be known.

Edit:
Trezor said they will begin anonymous delivery. Let us see how they would be.

[Faisal2202]

Since Bitcoin and crypto are the new gold mine if eventually Bitcoin goes up to $1 million dollars per coin this will make bad actors to even want to commit more crimes just to secure people's Bitcoin.

Secure or steal, well if they will take it from us then it is true they will keep it secured haha.

My worries is couriers or what are they called have your address and they know what you are buying since the receipt sometimes comes with the item glued to the case or package.

Call me crazy but I am just thinking ahead.

Wouldn't it be better for hardware wallet companies to handle shipping themselves and they will be able to erase data after delivery becomes a success? People who bought hardware wallet shouldn't be known by anybody.

They can't do that. Every company follows a chain. They always need courier services or 3PL logistics services because if there are 1,000 companies selling their products, not all of them can have these services of their own. It can cost them a fortune.

There is always a third person involved in the dealing, even if they start their own services.

So you can't expect them to change their methods because they are not obliged to. If you want complete privacy, then start finding how you can keep yourself safe, like giving them the wrong phone number or just the email which you only created for this purpose and should never use it again, so it won't link with your personal life. Don't give your home address. If there is an option of picking the parcel from the courier service, then select that. Don't choose home delivery for such important things.

[WellRozey]

If you want privacy, no need to buy a hardware wallet. You can set up your own hardware wallet by setting up an airgapped device and install a wallet like Electrum on it. This is my best solution. I do not like the situation that someone will know that you bought a hardware wallet.

I am not implying that the hardware wallets that are open source and reputed are not good, but people should know the privacy deprivation that may happen while buying one.

This comment is not encouraging.

You just simply said that buying a hardware wallet which was supposed to be the most secured way of keeping bitcoin means telling the world that you are a bitcoin investor.

Anyways, for educational reasons I will like to ask a question.

If someone like myself decided to run their own airgapped wallet using an abandoned device like old laptop or something how will I use Passphrase on such wallet?

Does Electrum has an option where passphrases can be added?

[Z-tight]

You just simply said that buying a hardware wallet which was supposed to be the most secured way of keeping bitcoin means telling the world that you are a bitcoin investor.

Not the whole world, just the wallet manufacturer. However, you would have to trust them not to leak your shipping details, which would obviously contain sensitive information about the buyer.

If someone like myself decided to run their own airgapped wallet using an abandoned device like old laptop or something how will I use Passphrase on such wallet?

Does Electrum has an option where passphrases can be added?

You simply extend your seed phrase with a passphrase as normal. If you are importing your seed or creating a new wallet in your airgapped machine, you check the option to extend your seed phrase with a passphrase and type it. Warning: You ought to know what you are doing before adding this extra layer of security, E.G. you should know that passphrases are case-sensitive and even punctuations count, so make sure to test that it works fine before moving your funds, so you don't lock yourself out of it.

[Asiska02]

Anyways, for educational reasons I will like to ask a question.

If someone like myself decided to run their own airgapped wallet using an abandoned device like old laptop or something how will I use Passphrase on such wallet?

Does Electrum has an option where passphrases can be added?

It is called seed extension in Electrum and it is a BIP39 style passphrase format. Using an Air gapped electrum wallet, you will first create your normal seedphrase for your default wallet backup. The pass phrase is an additional security to your wallet that can be created in order to access your wallet. Note that someone having your seed phrase does not give them access to your passphrase protected wallet. So it is required that you save your pass phrase separately.

You can have a watch only electrum wallet in your online device. For your airgapped old laptop, you can have your electrum wallet there, with your seed phrase and pass phrase protected also. You can also use the airgapped laptop to sign and approve transaction. This laptop will be offline but the security of it still depends on you, how you secure the old laptop. You are creating an extra security by using pass phrase, it should also be protected and because it is important to use it to access your wallet in order to sign transactions.

[Donneski]

The recent Trevor incident is a good  example of the risk you're tryna point out. Though the wallets weren't compromised, the personal information of those who were supposed to receive the wallets were exposed.

So yes, hardware wallet manufacturers are supposed to pay more attention to what happens to customer data after a purchase is completed so they don't end up becoming targets for patronising.

[YOSHIE]

Lately I've been thinking, is it really safe that couriers are the ones shipping hardware wallet that we purchased from official hardware wallet companies to our homes?

Four years ago I bought (Trezor One Cryptocurrency Crypto Hardware Hard Wallet Bitcoin Wallet) the purchase process was through an online site, which delivered the wallet by a courier, I checked carefully that the goods arrived in a sealed condition with no open gaps.
In essence, I have used this wallet until now without any problems, it is safe and under control.

I think couriers have no right to carry out unlawful actions against other people's goods, because they can be prosecuted legally.

However, a few months ago my friend also ordered a Trezor Bitcoin wallet, currently there are no problems, the data is safe, that's my experience, the point is I don't know of couriers in other countries.

[The Cryptovator]

Lately I've been thinking, is it really safe that couriers are the ones shipping hardware wallet that we purchased from official hardware wallet companies to our homes?

My worries is couriers or what are they called have your address and they know what you are buying since the receipt sometimes comes with the item glued to the case or package.

Yes, it’s right; when you order any physical goods at your home address and have a mobile number, then definitely the courier service will have your address. Probably they might know you are receiving a hardware wallet as well. If you feel threatened, then you have to think about alternatives to receive the hardware wallet, like someone else's address who doesn't use crypto.

For me, I have purchased from Dubai through one of my friends. Also, in my country, there are some customs rules, and there is some hassle as well in receiving something from abroad. I haven’t received one of my Trezors from customs due to hassle. You may think this way; receive your hardware wallet from somewhere else.

[sunsilk]

That is a valid concern.

There are bad people who looks at the data and knows the address of their potential victims. Much better to just pick up the package on the courier's office if it's possible to put that up.

Otherwise, don't have a choice but not to purchase a hardware wallet for that concern if the third party courier asks for your address.

I agree that the manufacturer themselves should have their own courier and not passing it to a third party service.

[Z-tight]

I have used this wallet until now without any problems, it is safe and under control.

Of course Trezor hardware wallet is safe to use, but that is not the point here. This is about their logistics and the data breach that occurred through their shipping partner, ShipMonk, which exposed sensitive data of more than 13k customers. You say you bought your device 4 years ago, so this breach doesn't affect you.

However, a few months ago my friend also ordered a Trezor Bitcoin wallet, currently there are no problems, the data is safe, that's my experience, the point is I don't know of couriers in other countries.

If it is within 90 days before this breach was reported, then your friend's personal info may likely be in the dark market right now. Trezor deletes shipping details of their customers, 90 days after purchase. So, with this information, customers can know if their data is part of those leaked. Take note that we are talking about a data breach, and not a compromise in Trezor hardware wallet.

[ZAINmalik75]

Such risks will always exist, and it can't only be limited to those ordering hardware wallets, because people buy so many things and get them delivered through courier services, and some of them might expose the receivers to have more money or wealth than someone who has bought a hardware wallet to keep their 0.02 bitcoins in it. So it's not that only the ones buying hardware wallets are at risk if customer data gets leaked or used for bad things, if something like that happens, it puts everyone at risk if bad actors get their hands on the data and decide to act on it.

I think it might actually be safer for one to decide a pick up location for receiving their wallet if they are thinking about the risk of exposing their address. When you choose a pick up location, your order is delivered there, and then you go and pick it up from there by confirming with a code or something that has been given to you by the sender or the courier service itself. It only exposes you to the person handling those parcels, but it won't expose your address.

[Livingleged]

The fact that I’m losing trust to the hardware wallet companies it self and not a third party shipment logistics as in this case. For me the companies you’re buying the device from also has workers that might not even be loyal to keep secrets of details of buyers. Which can also leads to data leaks resulting to wrench attacks just like the recent issue with the Trezor.
I think I fully agree with @ Charles Tim, that the best thing to do is not to buy any hardware wallet from any company, just set up an airgaped device and install Electrum wallet on it. This way nobody knows you have your own hardware wallet.

[salad daging]

I have used this wallet until now without any problems, it is safe and under control.

Of course Trezor hardware wallet is safe to use, but that is not the point here. This is about their logistics and the data breach that occurred through their shipping partner, ShipMonk, which exposed sensitive data of more than 13k customers. You say you bought your device 4 years ago, so this breach doesn't affect you.

ShipMonk is shipping for Europe, America, Canada and other parts while for the Asian region is not affected, in the future how? Of course not knowing what will happen later is clear we are also worried at this time with this news.

I bought Trezor from his website directly for several years ago, the data has been deleted by Trezor but still still receive emails that are not clear on behalf of Trezor, the tip of his tip leads to phishing links.

[ColdLava40]

If you want privacy, no need to buy a hardware wallet. You can set up your own hardware wallet by setting up an airgapped device and install a wallet like Electrum on it. This is my best solution. I do not like the situation that someone will know that you bought a hardware wallet.

I am not implying that the hardware wallets that are open source and reputed are not good, but people should know the privacy deprivation that may happen while buying one.

Open source wallets are good, but does not guarantee it being safe.

Hardware wallet gives the impression that everything is going to be fine after purchase but we are beginning to see a lot of reasons why there are not. Preferably I will have to agree on airgapped devices being a better option. It offers better security than any wallet setup both hardware or software.

Not until now are people beginning to look into some other aspect where their privacy can be removed. When you sign up on and input your data on these hardware site, you already lost it.

[Odusko]

With recent incidents of cold wallet data being leaked through courier services that depend on getting the hardware device delivered, and with wallet seed phrases being generated and delivered through third-party services. Those hardware wallet companies can no longer be trusted unless there are ways that buyers can create their own security keys when the devices is already delivered and in the custody of the end wallet user. Until then, various other means, like airgap device's that gives you leverage in security and privacy.