Is the myth of “absolute safety” debunked? Trezor 14,000 encrypted user information leaked, a “wrench attack” is approaching

DID YOU KNOW? Buying a hardware wallet is probably more dangerous than posting luxury cars on social media.

Because from the moment you place an order, your name, phone number, and address are permanently tied to the “hold crypto assets” label. And this information is probably lying in an Excel table from a dark web seller right now.

Trezor customers are being targeted.

On August 13, the hardware wallet giant confirmed that its logistics partner ShipMonk had been accessed without authorization, and 11,742 customers' names, emails, phone numbers, and full delivery addresses had been obtained; the names, cities, and emails of 1,947 other customers had been leaked, for a total of 13,689 people. The affected users are located in the US, UK, Sweden, Colombia, Brazil, Italy, and Portugal.

Note, Trezor's own system hasn't been broken, hardware moneyThe package is still secure, and the private key is fine.

So what's the problem?

The reason — buying Trezor became a “target” in itself.

This instantly turned an ordinary logistics database into a “list” in the eyes of potential attackers.

From a phishing email to someone knocking on your door

This kind of thing has happened quite a bit in the crypto industry.

In 2020, Ledger's e-commerce and marketing database was leaked. More than 1 million email addresses were leaked, and details such as the names, addresses, and phone numbers of about 272,000 customers were later made public. Since then, Ledger has had to remind customers for a long time to prevent phishing emails and scams impersonating official websites.

But today in 2026, things aren't just about the internet.

According to data released by Chainalysis in August this year, by the end of June, the world had recorded 46 violent attacks against crypto asset holders; more than half involved kidnapping, and more than one-third involved house robberies. Since 2026 alone, more than $30 million in crypto assets have been successfully stolen through violent coercion.

Insiders call it a “$5 wrench attack” ($5 wrench attack).

The name has a bit of dark humor, but the logic is scary: Hack a hardware wallet? It's so hard. But if I know you have coins and know where you live, then I only need to spend 5 dollars to buy a wrench and say “please” the mnemonic phrase at the door.

In January 2025, Ledger co-founder David Balland and his partner were kidnapped at their home in France. The kidnapper demanded a cryptocurrency ransom and severely maimed Balland's hand. French police later rescued two people, and several suspects were arrested.

In November 2025, Danylo K., the son of the deputy mayor of Kharkiv, Ukraine, and a 21-year-old student, was kidnapped in Vienna, tortured for a long time to obtain a wallet password, and then burned to death in gasoline. The suspect was later arrested in Ukraine and the associated crypto account has been emptied.

There is also an American interstate violent robbery gangA number of suspects are accused of posing as delivery workers or pizza delivery in California and other places, bundling and assaulting victims, and forcing money transfers. In one case, about 6.5 million US dollars of crypto assets were extracted in a single transaction; other gangs carried out similar attacks in several states, with cumulative losses of millions to tens of millions of US dollars.

The latest one is even more outrageous: a young couple in the French province of Somme (farmers and bank employees, who don't play with coins at all) bought a second-hand house. The former homeowner is a retired crypto-rich man. After the former landlord's tax information and old address were leaked to the dark web, from June 24 to July 17, 2026, they were robbed three times in less than a month. Although the two suspects have been jailed in the local court, the victim's lawyer pointed out that the dark web leak made the new owners innocent, and the couple are now preparing to sell their house and move.

This is where the “wrench attack” is really scary. You don't need coins, just someone else“Thought” you had, you're not safe anymore.

After “Not your keys, not your coins,” there's another problem

In fact, just two weeks before Trezor was released, another wallet manufacturer, Coldcard, had just experienced a key generation vulnerability crisis. Galaxy Research later estimated that the related losses had reached about 130 million US dollars.

As a result, Galaxy made a very interesting judgment: self-hosting does not eliminate the risk of hosting; it only transfers the risk to hardware, software, and key generation.

And Trezor this time,Taking the risk one step further:

The risk will also be transferred to logistics companies, order databases, your mobile phone number, and your home address.

Hardware wallets can be signed offline, so that private keys never touch the Internet, but from the moment an order is placed, users have already entered another system: e-commerce, payment, warehousing, logistics, and customer service.

Any part of this leak could connect an anonymous on-chain address to a person in the real world.

Jameson Lopp, the co-founder of Casa, who has been tracking physical attacks on cryptocurrencies for a long time, has been reminding coin holders for many years that the “$5 wrench attack” is no longer a joke. He gave it to high-net-worth coin holderssuggestionsYes: Show off your wealth less publicly, reduce social media exposure, and use multiple signatures to place keys in different locations, making it impossible to complete transfers right away even if you are coerced.

Anonymous delivery has arrived, but is it “absolutely” safe?

TRezor reacted very quickly after the incident: Starting in September, “anonymous delivery” was launched in the European Union — not directly linking hardware wallet purchases to home addresses or real identities.

This appears to be just an adjustment to the logistics process, but what is behind it means that the hardware wallet industry is redefining “security.”

Over the past ten years, the most spoken phrase in the crypto industry is: Not your keys, not your coins — not your private keys, not your coins.

As a result, more and more people are transferring assets from exchanges to cold wallets, thinking that the risk is over here.

But looking at it now, the real trouble began the moment you transferred the coins to a cold wallet.

Because when your wealth can be transferred to any part of the world within minutes, when transactions are almost irreversible, and when control depends only on a string of mnemonic words — the offenders quickly figure out the account:

Instead of spending months looking for technical bugs, it's better to find someone just like you.

You can hide your private keys in the safest place on Earth, but as soon as the courier knocks on your door, it all goes back to square one.

Author: Little Bear Cookies

Twitter:https://twitter.com/BitpushNewsCN

Compare the TG exchange group:https://t.me/BitPushCommunity

Compare TG subscriptions:https://t.me/bitpush