Innovation Product Manager

Hardware wallet buyers exposed as Trezor, SafePal vendor breaches fuel phishing. Trezor and SafePal customer data leaked through vendor breaches at ShipMonk and Brevo, fueling phishing and physical 'wrench attack' risks for wallet owners. * Subject - Trezor maker SatoshiLabs and rival SafePal * What happened - data breaches * Actor - attackers exploiting an SQL-injection zero-day in Metabase's Cloud SaaS platform * Status - confirmed a separate incident at Brevo * Incident - August 13, 2026 * Disclosed - August 13, 2026 * Source - https://www.helpnetsecurity.com/2026/09/08/trezor-shipping-partner-breach-phishing-attacks/ What happened. Two of the crypto industry's best-known hardware wallet makers have spent the last month disclosing data breaches that never touched a single device, a private key, or a seed phrase - because the attackers didn't need to. Trezor maker SatoshiLabs and rival SafePal both confirmed that customer names, addresses, phone numbers and purchase histories leaked through third-party vendors: a fulfillment company, an order-tracking plug-in, and an email marketing platform. The distinction matters because hardware wallets are marketed as the gold standard of self-custody. But a wallet's firmware being secure does nothing to stop a criminal who knows your name, home address and the fact that you own a device designed to hold cryptocurrency. That data is now circulating, and it is already being used to send phishing emails, fake security alerts, and - according to reports cited by TechCrunch - physical letters with QR codes designed to steal wallet backup passwords. IDScan Breach: 170 Million U.S. and Canadian IDs Allegedly Stolen (vertical) This video explains how hackers allegedly stole 170 million U.S. and Canadian IDs from ID verification company IDScan and are selling them on a Russian cybercrime forum. It's for consumers and security professionals who The facts, in order. * August 13, 2026: SatoshiLabs notified 13,689 Trezor customers that their names, home addresses, phone numbers and email addresses had leaked through fulfillment partner ShipMonk, per Shattered.io, a figure also confirmed by Help Net Security. Of those, 11,742 had full name, email, phone number and complete shipping address exposed; the remaining 1,947 had a narrower leak of name, city and email. * August 16, 2026: SafePal disclosed a separate authorization flaw in an order-tracking plug-in that exposed the names, email addresses, shipping addresses, phone numbers and purchase details of approximately 39,798 customers, notifying each individually by email from [email protected], according to The Hacker News. * Early September 2026: ShipMonk told customers its breach stemmed from attackers exploiting an SQL-injection zero-day in Metabase's Cloud SaaS platform, per Help Net Security. * September 4, 2026 update: SatoshiLabs said it learned two days earlier that ShipMonk had failed to purge an older set of records, exposing the full shipping data of approximately 67,000 additional US-based customers from orders placed between November 2019 and August 2021. * September 2026: Adding both Trezor disclosures together, the total climbed from under 14,000 to roughly 80,689 affected people, per Help Net Security. * Week of September 8, 2026: Trezor confirmed a separate incident at Brevo, the marketing platform it uses to send newsletters, after hackers accessed 138 Brevo accounts due to improperly scoped permissions and used them to send roughly 347,000 phishing emails to Trezor customers, per TechCrunch. Who is affected. The exposure spans two distinct breach chains. Trezor's ShipMonk-linked incident hit customers in the US, UK, Sweden, Colombia, Brazil, Italy, and Portugal, despite SatoshiLabs requiring shipping partners to delete or anonymize customer data after 90 days - a rule ShipMonk apparently failed to follow for older US orders. SafePal's exposure, tied to its own order-tracking plug-in rather than a shipping vendor, hit roughly 39,798 customers separately. Then there's the Brevo layer, which is arguably the most dangerous because it converts leaked contact data into an active attack channel. The phishing emails sent through the compromised Brevo accounts carried subject lines designed to trigger panic in security-conscious wallet owners - one read "Critical Security Alert: STM32 Entropy Vulnerability," engineered to look like a legitimate firmware warning. The malicious link in these emails, once tapped, downloads an app that asks the victim for their wallet backup password. Some customers have also received phishing letters by physical mail, complete with QR codes that open fake pages attempting to steal wallet passwords - a tactic that only works because the attackers know the victim's home address. This pattern of vendor-side compromise fueling downstream attacks echoes the broader trend covered in its reporting on the crypto vendor breach cluster, where the same Metabase vulnerability chain has now surfaced across multiple unrelated companies. It also reinforces the finding, detailed in Blockaid's H1 2026 data, that the large majority of stolen crypto this year traces back to infrastructure compromises rather than smart contract bugs. Why leaked shipping data is dangerous beyond phishing. The stakes extend past email scams. Physical "wrench attacks" - the industry term for kidnapping, home invasion or coercion used to force victims to hand over crypto - are rising sharply. Blockchain security firm CertiK confirmed dozens of reported wrench attacks in 2025, up 75% from the previous year, with robbers stealing upwards of $40 million. Chainalysis puts this year's figure at closer to $30 million so far, counting 46 violent incidents documented globally through late June, with gangs using kidnapping and home invasions to demand a person's crypto seed phrase. The trend line is unambiguous. A shipping database that ties a real name and home address to a purchase of a hardware wallet is, in effect, a target list for exactly this kind of crime. It doesn't matter that the wallet's firmware is uncompromised if an attacker knows where to show up. Separately, hackers have stolen more than $130 million in cryptocurrency directly off the blockchain by guessing passwords on Coinkite's The current wave of incidents is different in kind: no firmware bug, no cryptographic flaw, just ordinary vendor infrastructure that wasn't secured or wasn't purged on schedule. The response. Trezor has stated that none of its products, wallets, or account infrastructure were affected by either the ShipMonk or Brevo incidents - the company's core custody stack remains untouched. SatoshiLabs is now exploring anonymous delivery options for future orders, including dedicated checkout flows, locker pickup, neutral packaging, generic sender details, and automatic deletion of shipping identifiers after delivery. SafePal notified affected customers individually and disclosed the root cause as an authorization flaw in a third-party plug-in rather than a breach of its core systems. Brevo has posted incident status updates describing the account-level compromise but the phishing campaign it enabled had already reached hundreds of thousands of inboxes before it was contained. What to do. Hardware wallet owners whose data may have touched Trezor, SafePal or their vendors in the past several years should treat any unsolicited communication - email, mail or SMS - referencing wallet security as suspicious by default. * Do not click links in emails claiming to warn about firmware or "entropy" vulnerabilities; check vendor security advisories directly on the official site instead. * Never enter a wallet backup password, seed phrase or recovery phrase into any app, page or QR-code destination reached via an email or mailed letter. * Assume any address used for a hardware wallet order may now be known to criminals; consider a PO box or delivery locker for future purchases. * Enable multisig or additional passphrase protection where supported, since knowledge of your identity does not by itself unlock funds protected by strong operational security. * If you receive a physical letter referencing your wallet purchase, do not scan any QR code it contains; contact the vendor through its official support channel instead. * Watch for signs of being personally targeted - unusual surveillance, unexpected visitors, or direct contact referencing your crypto holdings - and treat these as potential precursors to a wrench attack, not just digital fraud. Sources. Ask Cipher about this article Get AI-powered insights, related threats, and expert context - powered by CISO Brain

$ 1495 for a hardware wallet: Trezor presented the most expensive product on the market - Steemit (2026). 6 years ago SatoshiLabs - a company that manufactures Trezor products - will work with the designer company GRAY to produce a luxury hardware wallet called Corazon. The cheapest option, Corazon Titanium, will cost $ 695, the other versions are much more expensive: Corazon Stealth - $ 995, and Corazon Gold - $ 1,495. The brand GRAY previously worked, in particular, on the Zyra and Alter Ego collections for Apple devices. It should be noted, the most expensive device from Ledger costs $ 319, and from KeepKey - $ 129. Before the announcement of the release of the new product, the most expensive device from Trezor was retailing for $ 690. One of the key features of these devices is that they are all made of aerospace grade 5 titanium, which is used in aeronautics, as well as in formula 1. According to GRAY, this material is 2.5 times stronger than stainless steel but weighs two less. In addition, the wallet has a reinforced case, which should protect it from external physical threats. The main difference between the versions is in the type of coverage. Corazon Titanium is available only in a titanium shell, the Stealth version comes with a black PVD coating, and the most expensive version has a gold PVD coating. The supply volume of the new product is slightly limited: only 500 Corazon Stealth devices will be available for purchase, and Corazon Gold version will be released in 100 copies. Krypto enthusiasts can already pre-order Corazon models using BTC and BCH via Bitpay, and traditional credit cards are also accepted. Delivery of the product is scheduled for the end of April. Recall that in December, Marek Palatinus, CEO of SatoshiLabs, stated that the company is working to provide support for the Lightning Network and Liquid with Trezor hardware wallets: -In addition, Healthabitravels is working to ensure the use of SD cards in the Trezor Model T model to protect the encrypted passwords and files of its users. Top Articles Article information Last Updated: 2026-07-25T14:08:37+07:00 Views: 6431 Rating: 4.7 / 5 (77 voted) Name: Gregorio Kreiger Birthday: 1994-12-18 Address: 89212 Tracey Ramp, Sunside, MT 08453-0951 Phone: +9014805370218 Job: Customer Designer Hobby: Mountain biking, Orienteering, Hiking, Sewing, Backpacking, Mushroom hunting, Backpacking Introduction: My name is Gregorio Kreiger, I am a tender, brainy, enthusiastic, combative, agreeable, gentle, gentle person who loves writing and wants to share my knowledge and understanding with you.