Hardware Wallets Are Air-Gapped. Their Shipping Records Are Not.

Breaches at shipping partners for Trezor and SafePal exposed names, home addresses, emails, and phone numbers of roughly 14,000 Trezor customers plus an undisclosed number of SafePal users. The hardware wallets themselves were not compromised. The structural problem is that purchasing an air-gapped wallet creates a physical-address data trail linking the buyer to likely cryptocurrency holdings — a curated target list for coercion-based "wrench attacks," which CertiK says rose 75% in 2025 with losses exceeding $40 million.