Trezor and SafePal Data Breaches Expose a New Risk for Crypto Hardware Wallet Owners
Trezor and SafePal are warning hardware wallet customers after separate security incidents exposed names, addresses, phone numbers, emails and purchase details tied to tens of thousands of crypto buyers.
The wallet keys stayed offline, but the leaked address data opens a much more uncomfortable door.
➜ The real story: Crypto security isn’t just about keeping a seed phrase off the internet anymore. If an attacker knows who bought a hardware wallet and where that person lives, the risk can move from the screen to the front door.
Trezor ShipMonk and SafePal Data Breaches Exposed Hardware Wallet Customer Details
Trezor says a breach at shipping provider ShipMonk exposed full contact and shipping information for 11,742 customers, plus more limited data for another 1,947.
SafePal says unauthorized access to an order-tracking system exposed information tied to about 39,798 customers.
Neither incident exposed seed phrases, private keys or wallet passwords, but both companies are warning users about more convincing phishing and impersonation attempts.
It’s the same supply-chain problem seen when a CEVA Logistics data breach exposed Steam hardware buyers: the product can stay secure while the delivery trail around it becomes the weak point.
Crypto Hardware Wallet Security Now Includes Phishing and Physical Wrench Attacks
That matters more with crypto because a leaked home address can carry a different kind of value.
Seventy-two verified physical coercion incidents were documented in 2025, up 75 percent year over year, with more than $40.9 million in confirmed losses.
These so-called wrench attacks can involve kidnapping, home invasion, robbery or coercion designed to force someone to surrender access to crypto.
A hardware wallet can keep private keys away from online attackers, but it can’t make the owner anonymous.
What Trezor SafePal and Coldcard Hardware Wallet Owners Should Do Now
There’s also a separate hardware warning hanging over this story. A recent Coldcard seed-generation flaw left affected wallets with weaker randomness, creating a path for attackers to predict seed phrases and steal funds without ever touching the physical device.
Fixed firmware is available, but updating alone doesn’t repair a seed that was already generated on vulnerable firmware.
For hardware wallet owners, that’s a useful reminder that “offline” is a strong security layer, not a magic force field.
Trezor and SafePal customers who received breach notices should treat unexpected emails, texts, calls, letters and even hardware deliveries as suspicious. Don’t share a seed phrase or private key, and don’t enter recovery words into a website because somebody claims an account needs urgent verification.
If you need to check an alert, go directly to the wallet maker instead of following a message link.
For the bigger picture, Spacelab’s latest cybersecurity news and phishing guides track the same shift toward attacks that combine leaked personal data with very believable social engineering.
FAQs
Were Trezor or SafePal Seed Phrases Exposed in the Data Breaches?
No. The incidents exposed customer order and contact information, not seed phrases, private keys, wallet passwords or direct access to wallet funds.
How Many Trezor and SafePal Customers Were Affected?
Trezor says about 13,689 customers were affected, while SafePal says information tied to about 39,798 customers was accessed.
What Should Crypto Hardware Wallet Owners Do After a Data Breach?
Treat unexpected messages, calls and letters as suspicious, never share a seed phrase or private key, and verify alerts by going directly to the wallet maker’s official site or app.
