Trezor and Safepal the data was leaked

[MArsland]

complete information:
https://x.com/Trezor/status/2087885428313543059
https://x.com/SafePal/status/2088937173139812792

Trezor and Safepal the data was leaked including information that includes name, email address, shipping address, phone number, and purchase details, please be careful with your bitcoin assets, it is feared that the incident is the same as the coldcard case.
Lately the attacks on cold wallets are massive, always check periodically your assets if they are there.

[Smack That Ace]

Lately the attacks on cold wallets are massive, always check periodically your assets if they are there.

Thank you for sharing this update.

Actually there is no chance of massive attack on cold wallets here. Because no system or device have been compromised here.

With this leaked data attacker might be able to do targeted phishing or impersonation. Because attacker will be able to understand who the Trezor customer is. In fact just checking the wallet balance periodically will not reduce this risk. We should not give seed phrase, passphrase, wallet credentials in any unexpected email or DM. And do not follow any security update except through official channel.

[Mitchell]

Trezor is already being discussed here: https://bitcointalk.org/index.php?topic=5591152.0
SafePal is being discussed here: https://bitcointalk.org/index.php?topic=5591377.0

[MArsland]

Lately the attacks on cold wallets are massive, always check periodically your assets if they are there.

Thank you for sharing this update.

Actually there is no chance of massive attack on cold wallets here. Because no system or device have been compromised here.

With this leaked data attacker might be able to do targeted phishing or impersonation. Because attacker will be able to understand who the Trezor customer is. In fact just checking the wallet balance periodically will not reduce this risk. We should not give seed phrase, passphrase, wallet credentials in any unexpected email or DM. And do not follow any security update except through official channel.

You are right, the system of the device may not be hacked but what I fear is that there are cases like in France when the data of the owner of the asset is leaked and the data is traded and the victim becomes the target of theft, burglary of the house until the victim experiences a threat if he does not provide the private key.

[mocacinno]

always check periodically your assets if they are there.

Well, your funds are either there, or they are not... Checking periodically is basically only usefull for contacting law enforcement and for your peace of mind.
If an attacker is going to steal your funds right now, it wouldn't have mattered if you checked your wallet an hour ago, it would have looked like nothing had happened, and if you'd check in 10 seconds and you realized you were robbed, there would be almost nothing you could do as a "normal" user, and as soon as the robber's transaction is confirmed, it would be next to impossible to change anything (you'd have to do a 51% attack to rewrite the blockchain).

It comes down to either trusting your funds are safe, or not trusting your funds are safe. If you don't trust your funds are safe, it might be time to switch wallets... If you really want to check periodically, you might want to use a watch only wallet.

[TedMosby]

The data that was leaked may not be as technical as a seed phrase or anything directly related to a Bitcoin wallet. However, I think it doesn't mean it's less dangerous. Imagine those who got that leaked data now know your address, phone number, etc. Imagine those who receive the wallet are not really paying attention to this news. Then they get an email or phone call from Trezor/SafePal "Tech Support".

Scammer: Hey, is this Mr. John Doe?
Victim: Yes, I am. Who is this?
Scammer: We are from SafePal/Trezor. We want to double check first, is [address] your address? You purchased the wallet on [date], right?
Victim: *Confirming that it's true and starting to believe it's real tech support*.
Scammer: We are glad to inform you that you won our giveaway, blah blah blah... The reward is claimable by...
Victim: *Click*.

Apart from online scams, they can also be a subject of offline crimes too, like kidnapping, extortion, etc.

[Darker45]

With this leaked data attacker might be able to do targeted phishing or impersonation. Because attacker will be able to understand who the Trezor customer is. In fact just checking the wallet balance periodically will not reduce this risk. We should not give seed phrase, passphrase, wallet credentials in any unexpected email or DM. And do not follow any security update except through official channel.

There are many more ways to attack the targets other than phishing and impersonation.

I can only hope that all the owners of these hardware wallets whose personal data were leaked are fully aware of the things they need and need not do in order to keep their funds safe. Unfortunately, I expect otherwise. And even if they're extra careful in all their actions, they still can't avoid extortion attempts and physical threats.

When a similar breach happened with Ledger, millions were accordingly lost. Attacks came in different forms. There were even fake devices sent out as replacements. Wallets were drained as a result.

I won't be surprised if the same actors were behind the attack on Trezor and Safepal customer data. The first time they did it with Ledger partners, it was profitable.

[noorman0]

-snip-
it is feared that the incident is the same as the coldcard case.

This type of attack differs from the Coldcard wallet (which involved firmware bugs); this involves a leak of user data that is typically sold on the dark web. At worst, the attacker might send an "official" letter to your home address or attempt a "$5 wrench attack" to steal your keys.

[mocacinno]

At worst, the attacker might send an "official" letter to your home address or attempt a "$5 wrench attack" to steal your keys.

There is nothing, literally nothing, i fear most than a $5 wrench attack when it comes to crypto... I would not call this "at most", it is the very worst case scenarion... I would not want to wake up and see some criminal in my bedroom. I have a family, i'd rather fall victim to a phone scam than never being able to trust the security of my own house.

[savetheFORUM]

You are right, the system of the device may not be hacked but what I fear is that there are cases like in France when the data of the owner of the asset is leaked and the data is traded and the victim becomes the target of theft, burglary of the house until the victim experiences a threat if he does not provide the private key.

You're saying it differently here than how you said it in the OP:

please be careful with your bitcoin assets, it is feared that the incident is the same as the coldcard case.
Lately the attacks on cold wallets are massive, always check periodically your assets if they are there.

The incident is obviously not the same as the coldcard case, because in that case, the vulnerability allowed the attackers to find out the seed phrase of each wallet and then used that to steal their bitcoins, but in this case, it's just personal information of those who bought their wallets. So, what you said later about how it can create physical threats to the customers is actually the problem with such cases, because those who have these details will now have every information about people who potentially have some bitcoins that they can rob.

Well, one thing is certain, all these incidents of exploits and data breaches are only going to affect the reputation of Bitcoin and decentralization as a whole, and this needs to be stopped and controlled. Companies need to be more careful with the data of their customers.

[Don Pedro Dinero]

I’m very pessimistic about this news; it’s just more drops filling the glass, and at some point it’s going to overflow. Does anyone still believe in a future of widespread P2P adoption where users manage their Bitcoin using their own seeds?

I reckon that the future of Bitcoin will be rather like that of any other commodity traded on Wall Street, where the bulk of trading volume comes from paper contracts, not the commodity itself, and in this case we already have Larry Fink and Michael Saylor managing a huge amount of the commodity, a trend that is only set to grow.

[Lucius]

I’m very pessimistic about this news; it’s just more drops filling the glass, and at some point it’s going to overflow. Does anyone still believe in a future of widespread P2P adoption where users manage their Bitcoin using their own seeds?

I will not give up the "not your keys, not your coins" approach, regardless of the fact that such things happen - because I have already written that most people can maintain their privacy when buying hardware wallets, whether they buy them in physical stores for cash or order them online in a PO Box.

In my opinion, what is extremely worrying is that people still do not try to protect their privacy after the massive data leak by Ledger, even 6 years have passed since then.

I reckon that the future of Bitcoin will be rather like that of any other commodity traded on Wall Street, where the bulk of trading volume comes from paper contracts, not the commodity itself, and in this case we already have Larry Fink and Michael Saylor managing a huge amount of the commodity, a trend that is only set to grow.

I think you're not far from the truth, because the people you mention have had very negative opinions about BTC in the past, but for years they have been shaping the narrative that Bitcoin is something completely different from what its creator imagined. Ordinary people cannot compete with such players, but what they can do is not participate in such a game, because there is only one correct way to own Bitcoin, and that is to store it in non-custodial wallets.

Some will say that even hardware wallets are no longer a safe way to do that, but I would disagree if we have a different approach - let's choose only those that have a good reputation, protect our seed with a unique and strong passphrase or multisig and save backups safely.

[Catenaccio]

I will not give up the "not your keys, not your coins" approach

My keys, my coins, this is a vital principle and I have to maintain it, so I really agree with you.

regardless of the fact that such things happen - because I have already written that most people can maintain their privacy when buying hardware wallets, whether they buy them in physical stores for cash or order them online in a PO Box.

Hardware wallets need to be bought rightly too, after people already chose a good hardware wallet to purchase, they must do later steps properly.

[LIST] Open Source Hardware Wallets
[GUIDE] How to buy a Hardware Wallet the right way

In my opinion, what is extremely worrying is that people still do not try to protect their privacy after the massive data leak by Ledger, even 6 years have passed since then.

Privacy is very important too.
The value of privacy.
Bitcoin privacy guide.
Modest privacy protection proposal.
Can you really disappear from the Internet?

[Ambatman]

Is this like an attack on open source project or ones pertaining to decentralization.
After the Coldcard breach I expected more of these to sprang up
And I'm sure even if we don't want to
This isn't the last of it.

Bitcoin decentralised or pseudonymous nature isn't enough to protect you
You have to also work in protecting your data.

[YOSHIE]

Lately the attacks on cold wallets are massive, always check periodically your assets if they are there.

What actually happens with Bitcoin cold wallets, is your information this A1 because I am also one of the people who use Trezor wallet.

If it's true what you say, maybe I should do something about Bitcoin assets but be safe, this is really messed up for Bitcoin wallets, yesterday Coldcard, now Trezor and Safepal are having problems this is really bad.

So, which other Bitcoin wallet should we use, maybe when we use another wallet the same thing will happen, is this a rival or a new strategy for how to steal other people's Bitcoins.

[taufik123]

I’m very pessimistic about this news; it’s just more drops filling the glass, and at some point it’s going to overflow. Does anyone still believe in a future of widespread P2P adoption where users manage their Bitcoin using their own seeds?

I will not give up the "not your keys, not your coins" approach, regardless of the fact that such things happen - because I have already written that most people can maintain their privacy when buying hardware wallets, whether they buy them in physical stores for cash or order them online in a PO Box.

In my opinion, what is extremely worrying is that people still do not try to protect their privacy after the massive data leak by Ledger, even 6 years have passed since then.

It's actually about how people do more protection for their own privacy, by not engaging with original information online, then this will be quite safe.
Like those who use Po Box as you described, to disguise real addresses and also use backup phone numbers and emails (not primary numbers and emails), so it will be safer in the event of a data leak like this.

I always differentiate information for online and offline, never using a personal email or primary email for crypto, as there will be a lot of phishing popping up in my Inbox.

Data leaks like this if you know, in my country in Indonesia have even happened quite often on marketplace platforms
and other service provider platforms that have a lot of sensitive data that is then traded on the BreachForums forum, so I am not surprised by this kind of news.


After all, the leaked Safepal data for buyers who placed an order between March 2, 2025 and April 11, 2026,
while I had Pre-Order Safepal April 2021, is quite far gap and my data may still be safe even if it is not the original data.

[OcTradism]

What actually happens with Bitcoin cold wallets, is your information this A1 because I am also one of the people who use Trezor wallet.

If it's true what you say, maybe I should do something about Bitcoin assets but be safe, this is really messed up for Bitcoin wallets, yesterday Coldcard, now Trezor and Safepal are having problems this is really bad.

So, which other Bitcoin wallet should we use, maybe when we use another wallet the same thing will happen, is this a rival or a new strategy for how to steal other people's Bitcoins.

The risk management principle is diversifying the risk, so don't use only one wallet to store all your bitcoin.

With the growth of AI, it will bring more security risk to wallet softwares, wallet manufacturers and users too.
The rise of machines.

As Bitcoin users, we can not know what are coded by developers, and only very little people who are able to verify codes with open-source wallets, while with the majority of Bitcoin users, we have to trust developers, manufacturers and technical security reviewers.

Therefore, we only can diversify our bitcoin storage, and avoid losing all bitcoin by any data breach, security breach of a single wallet brand or model.