Crypto: A Leak at a Trezor Subcontractor Exposes the Details of 13,689 Clients

Trezor has just warned 13,689 clients after a data leak at one of its logistics providers. Names, emails, phone numbers, and delivery addresses were exposed according to the affected users. Wallets were not hacked and no private key leaked. Good news therefore for cryptocurrencies. A bit less so for personal data.

Trezor confirms the leak of 13,689 clients

The incident does not come directly from Trezor. It concerns a provider used for shipping its hardware wallets. The manufacturer had already warned its users against fake support emails. 11,742 clients are the most exposed. Their names, delivery addresses, emails, and phone numbers are in the compromised data.

For 1,947 other people, the leak only concerns the name and email address. Total: 13,689. The affected clients are located in the United States, United Kingdom, Sweden, Colombia, Brazil, Italy, and Portugal. Trezor specifies that the affected orders date back to the 90 days before August 8.

The manufacturer especially insists on what did not leak. No wallet backup, recovery phrase, or private key appears in the concerned data. The Trezor devices therefore remain secure.

This is not a detail. A person who obtains a name, email, and address cannot directly move the bitcoins or other cryptos stored on the wallet. However, they have enough information to prepare something else.

Phishing becomes the main risk in crypto

Hardware wallet owners are interesting targets for fraudsters. They already hold cryptos and place enough importance on their security to invest in a specialized device.

With an email address, a hacker can send a fake Trezor message. With the name and phone number, they can personalize their approach. And with the delivery address, they even know where the wallet was sent. The attempt immediately becomes more credible.

The sector is already familiar with this scenario. Ledger customers had been targeted by phishing after a leak related to the provider Global-e.

Fraudsters generally seek to obtain the recovery phrase. Fake technical support, fake urgent update, imaginary problem on the wallet: the pretexts are many. Trezor therefore recalls a simple rule. The company never asks for a customer’s wallet backup.

There is also the physical address. It does not allow any cyberattack on the wallet, but it potentially reveals the residence of a person who owns cryptos. Not ideal. Trezor is now conducting an investigation with the concerned provider and contacting directly the clients whose information was exposed.

Trezor wants to make its deliveries more anonymous

This leak mainly shows that the security of a hardware wallet does not stop at the hardware wallet. The device can be perfectly protected. Yet it still needs to be ordered, paid for, shipped, and delivered somewhere. Several companies can be involved between the purchase and the delivery.

Trezor claims to have imposed data retention rules on its partners. The incident occurred despite these precautions.

The manufacturer is now working on a feature called “Anonymous Delivery.” The principle should reduce the personal information needed to receive a device. Trezor has not yet fully detailed how it works.

The idea comes at the right time. Wallet manufacturers regularly face issues related to services around their products. Ledger and Trust Wallet have also experienced several security incidents. The 13,689 Trezor clients have not lost their cryptos. That is the main thing. However, they will need to watch their next emails and SMS a bit more carefully. Fraudsters did not obtain their keys. They obtained enough to try to get them to give them up.