Data Breaches at Shipping Companies Increase Risks for Cryptocurrency Wallet Owners

Data breaches affecting two shipping companies have raised concerns for cryptocurrency users with hardware wallets, revealing vulnerabilities in the tech infrastructure supporting the crypto industry. The breaches have resulted in the theft of personal information from thousands of customers of Trezor and SafePal, two prominent hardware wallet manufacturers.

In recent weeks, both companies disclosed that the breaches at their shipping partners led to unauthorized access to their customers’ names, home addresses, email addresses, and phone numbers. This data was originally shared for the purpose of shipping hardware wallets to customers.

While the security of the hardware wallets themselves remains intact—due to their offline nature making online hacking much more difficult—the breaches have highlighted serious concerns regarding the security of the supply chain. The stolen information could expose high-net-worth individuals to physical attacks designed to forcibly extract crypto seed phrases, critical codes necessary for accessing their digital assets.

These physical assaults, commonly known as wrench attacks, have seen an alarming increase. According to blockchain security firm CertiK, there were dozens of wrench attacks reported in 2025, an increase of 75% compared to the previous year, with criminals successfully stealing over $40 million in cryptocurrency. Chainalysis, a notable figure in crypto forensics, reported that this year alone has seen around $30 million stolen via methods such as kidnapping and home invasions aimed at acquiring seed phrases.

In addition to the risks of physical attacks, Trezor and SafePal have cautioned their clients about the dangers of phishing attacks, which manipulate targeted messaging via email or phone to deceive individuals into revealing their crypto information.

Further complicating the security landscape, a separate incident this month saw hackers steal more than $130 million in cryptocurrency from Coinkite’s Coldcard hardware wallets. These unidentified hackers were able to exploit a vulnerability in the wallet’s password generation system, successfully guessing seed phrases that had never been online. Despite taking all security precautions, one victim lamented that a previously undiscovered 2021 vulnerability compromised their defense, leading to their substantial loss.