Data breaches at two shipping companies has put cryptocurrency owners with physical hardware wallets at greater risk of having their funds stolen, highlighting weaknesses in the broader tech ecosystem relied on by the crypto industry.
In recent weeks, makers of hardware crypto wallets Trezor and SafePal reported that collectively thousands of their customers had their personal data and shipping information stolen during separate data breaches at their shipping partners. The crypto wallet makers provided their customers’ names, home addresses, email addresses, and phone numbers to the shipping companies for mailing out their hardware wallets.
The hacks did not affect the security of the wallets, a hardware device that stays offline to make it far more difficult for hackers to compromise from over the internet. Instead, the hackers targeted the broader supply chain of tech companies to obtain personal information about where high-net worth crypto holders live.
By stealing the names and home addresses of hardware wallet customers, the hacks expose crypto owners to physical attacks that rely on physically obtaining the seed phrase stored on the wallet by force or violence.
Known as wrench attacks (referring to the use of weapons), these kinds of real-world attacks are on the rise as criminals increasingly seek out crypto belonging to high-net individuals. Blockchain security company CertiK confirmed dozens of reported wrench attacks during 2025, up by 75% on the previous year, with robbers stealing upwards of $40 million. Crypto forensics giant Chainalysis puts this year’s figures at closer to $30 million so far, with gangs using kidnapping and home invasions to demand a person’s crypto seed phrase.
With knowledge of a person’s seed phrase, the attackers can irreversibly take control of the person’s crypto on the public blockchain.
Both Trezor and SafePal also warned customers to stay vigilant against phishing attacks, which rely on sending targeted messages to a person’s phone number or email address in an attempt to steal their crypto.
In a separate attack on a hardware wallet earlier this month, hackers stole more than $130 million in cryptocurrency directly off the blockchain by guessing the passwords set by Coinkite’s Coldcard hardware wallet.
The hackers, who have not yet been identified, were able to predict the seed phrases that Coldcard wallets would generate offline for their customers. Even though the wallets and seed phrases never touched the internet, the hackers were able to generate customer wallet passwords on the fly and pluck their funds directly off of the blockchain.
One victim said in a post on X that they had done “everything right,” but that “none of it mattered… all because the hardware that created the seed phrase originally had one line in their code from 2021 that had a vulnerability.”
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.
Zack Whittaker is the security editor at TechCrunch. He also authors the weekly cybersecurity newsletter, this week in security.
He can be reached via encrypted message at zackwhittaker.1337 on Signal. You can also contact him by email, or to verify outreach, at zack.whittaker@techcrunch.com.
October 13 – 15 San Francisco Scale faster. Grow your portfolio. Gain practical expertise. No matter your goal, Disrupt can empower you.Save up to $300 today!
Most Popular If Apple sends you a push notification alerting you to a spyware attack, take it seriously Zack Whittaker
Some Claude users are mad that Anthropic’s new watermarks will catch them using it at their jobs, classes Lucas Ropek
After Microsoft threatened legal action, a security researcher publishes a new Windows zero-day bug Zack Whittaker
Everything announced at Made by Google ’26: Pixel 11, Pixel Watch 5, Pixel Tag, and tons of Gemini features Lauren Forristal
Phoebe Gates and Sophia Kianni reportedly knew Phia was ‘cookie stuffing’ for months Dominic-Madori Davis
Delta investigating after someone set up fake Wi-Fi network mid-flight Lorenzo Franceschi-Bicchierai
Anthropic says it will watermark text generated by its AI models Ivan Mehta
---
**İlgili Kaynaklar:**
Profesyonel SEO ve GEO eğitim platformu çözümleri için [GEO eğitim](https://geoakademi.com) sayfasını ziyaret edin.
