This isn't news anymore.
Ledger's January incident, Trezor's August shipping-provider breach, and SafePal's August incident exposed customer information, including shipping addresses. In September, Trezor disclosed another incident involving 347,149 newsletter email addresses. Most recently, Keystone reported a website breach exposing customer details and order information.
Although not exposing private keys or recovery phrases, leaked personal data creates serious phishing and physical-security risks. Ledger's 2020 breach had already exposed approximately 272,000 customers' detailed records, including home addresses (Ledger's official statement).
Your private keys may stay offline, but your personal information doesn't necessarily stay private.
Also read:
- I have trust issues with hardware wallets. (And so should you.) — Why a wallet manufacturer's handling of customer data deserve serious scrutiny.
- Dark times for secure elements (SE) and hardware wallets — Discussion of hardware wallet security assumptions and secure elements.
- User reports their Coldcard wallet being drained on Reddit — A discussion of the Coldcard seed-generation vulnerability and its implications for self-custody.
- COLDCARD Security Update: Seed Generation, Transaction Integrity, and Data Isolation — Security findings, firmware updates, and recommendations for affected users.
- Compass Mining Breach August 10th 2026 — Another example of how customer account data can be exposed even when wallet funds and mining operations aren't directly compromised.
Companies and their third-party providers can become privacy weak points.
Privacy is not merely about hiding secrets; it's about protecting yourself and your family.
As Edward Snowden put it, “We don’t have to give up privacy to have good government, we don’t have to give up liberty to have security.” (Source: TED Blog)
Did you use your real home address when ordering your hardware wallet?