Your crypto wallet is only as safe as the delivery company that sends it. Trezor and SafePal, hardware wallet makers, said that breaches at two shipping firms exposed customer names, street addresses, emails, and phone numbers.
The wallets themselves were never touched, and the offline devices remain hard to hack over the internet. But the attackers didn't need the wallets. They went after the supply chain to find wealthy crypto holders, and now those people have a new problem: strangers with their home address.
Both companies also warned customers to watch for phishing messages sent to their phones or email addresses. That warning is a sign of how the threat has moved from the keyboard to the front door.
Hardware wallets are designed to keep seed phrases offline, but a seed phrase is also the single key to a user's funds. If someone obtains it, they can move the crypto without needing the physical device. This is why a leaked home address can be as dangerous as a leaked password.
With a name and address, criminals can take a more direct approach. They show up at your door and force you to reveal your seed phrase, the long string of words that unlocks your crypto forever.
In 2025, CertiK verified reports of dozens of wrench attacks. That is up 75% from the year before. Thieves stole more than $40 million through these attacks last year, according to CertiK. Chainalysis, a blockchain data firm, estimates that close to $30 million has been stolen this way so far this year as of August 17, 2026, sometimes through kidnappings and home invasions.
Once an attacker has your seed phrase, they can take over your crypto permanently. There is no bank to call for a refund, and no transaction review board to appeal to.
You might think keeping your seed phrase offline keeps you safe. Then there's the case of Coinkite's Coldcard wallets. Earlier this month, hackers stole over $130 million in crypto by predicting seed phrases that these devices generated offline and guessing wallet passwords set by Coinkite's Coldcard hardware wallet.
The wallets never went online, but the attackers still recreated the passwords and drained the funds straight from the blockchain. One victim told the story on X. They had followed all the good security practices, but a vulnerable line of code from 2021 had generated their seed phrase. That was all it took.
The attack worked because the seed phrases were not truly random. They came from a predictable source, and the attackers figured out the pattern.
The takeaway here is not to panic, but to pay attention. Hardware wallets are still one of the safest ways to hold crypto, but they only protect you from online thieves. The real-world risks are getting harder to ignore, and the people behind these attacks are getting more creative.
If you own a hardware wallet, it's worth thinking about what information is out there and how easy it would be for someone to find you. The same address you used for delivery could be the one that shows up on a list. A little paranoia might be healthy, but so is knowing that the technology itself is not the only weak link.