Post
--
可可529
·
--
Trezor again suffers a data leak: the names, phone numbers, and home addresses of 14,000 users were all exposed.
This time, it wasn’t hackers breaking into Trezor itself, but a logistics provider, ShipMonk, getting breached by an SQL injection. The attackers obtained order data, not private keys. But the problem is exactly here—“Your coins are safe, but everyone online now knows who you are and where you live.”
The wallet brand printed on the shipping label means the recipient is openly declared to be “a coin holder.” Combined with the name, phone number, and home address, the precision is high enough to make phishing emails, scam calls, and even in-person robberies extremely convincing.
Even more heartbreaking: this is the second hardware-wallet security incident in two weeks. On July 30, Coldcard suffered a vulnerability that led to theft of over $100 million. Hardware wallets have long marketed themselves as “absolutely secure.” Now it looks like this— they only protect your private keys; they don’t protect you, the person.
Chainalysis data shows that this year there have already been 46 incidents of violent attacks targeting coin holders, with kidnapping accounting for more than half. This isn’t meant to scare you.
Trezor says it will introduce anonymous shipping in the EU in September—but before the damage is contained, 14,000 people have already been exposed.
No wallet is colder than the risks in the real world. When buying a hardware wallet, first think about how to keep others from knowing you bought one.
This time, it wasn’t hackers breaking into Trezor itself, but a logistics provider, ShipMonk, getting breached by an SQL injection. The attackers obtained order data, not private keys. But the problem is exactly here—“Your coins are safe, but everyone online now knows who you are and where you live.”
The wallet brand printed on the shipping label means the recipient is openly declared to be “a coin holder.” Combined with the name, phone number, and home address, the precision is high enough to make phishing emails, scam calls, and even in-person robberies extremely convincing.
Even more heartbreaking: this is the second hardware-wallet security incident in two weeks. On July 30, Coldcard suffered a vulnerability that led to theft of over $100 million. Hardware wallets have long marketed themselves as “absolutely secure.” Now it looks like this— they only protect your private keys; they don’t protect you, the person.
Chainalysis data shows that this year there have already been 46 incidents of violent attacks targeting coin holders, with kidnapping accounting for more than half. This isn’t meant to scare you.
Trezor says it will introduce anonymous shipping in the EU in September—but before the damage is contained, 14,000 people have already been exposed.
No wallet is colder than the risks in the real world. When buying a hardware wallet, first think about how to keep others from knowing you bought one.
Disclaimer: Includes third-party opinions. No advice. Binance AI may be used without guarantee. See T&Cs.