What Broke Was the Purchase Record, Not the Device: The Threat Model of Self-Custody Has Moved

What Broke Was the Purchase Record, Not the Device

On August 13, 2026, Trezor disclosed that an unauthorized party had obtained customer order data through a breach at ShipMonk, one of its shipping providers. The company was notified on August 10.

The exposed data comprises the information required for delivery: full names, shipping addresses, phone numbers and email addresses. Full exposure affected 11,742 customers, while partial exposure limited to name, city and email address affected 1,947, for a total of approximately 13,689 people. The affected orders were shipped between May 10 and August 8, 2026 to the United States, United Kingdom, Sweden, Colombia, Brazil, Italy and Portugal. Japan was not among them.

Trezor states clearly that its own systems were not compromised and that hardware wallets, private keys and wallet backups were unaffected. That is almost certainly accurate. Yet the company also acknowledges that this is the first time since its founding in 2013 that customer phone numbers and shipping addresses have been exposed, and it describes the seriousness in unusually direct terms.

The cryptographic boundary held. What broke was the boundary around information about who is using that cryptography and where they live.

A Ninety-Day Retention Policy Determined the Scale of the Damage

The second point worth noting is that the size of the exposure was determined not by cryptography or security products but by a data retention policy.

Trezor deletes or anonymizes purchase data from its own store ninety days after delivery, and it contractually imposed the same condition on its fulfillment partners. By the company's explanation, ninety days was chosen as the shortest window that still covers the full life of an order, including delivery, returns, refunds and replacements. As a result, orders older than ninety days no longer existed in ShipMonk's systems, and exposure was capped at roughly 13,689 people.

For comparison, the incident Ledger experienced in 2020 exposed personal information for around 270,000 people through an e-commerce platform. On January 5, 2026, Ledger disclosed a further incident in which customer names, addresses, email addresses and phone numbers were accessed through Global-e, its cross-border e-commerce and payment platform. There too, neither Ledger's own systems nor its hardware were compromised.

The same structural failure keeps recurring through different vendors. What separated the outcomes was not spending on security but design choices about how little data to hold. Data minimization is, before it is a compliance requirement, an engineering parameter that sets the ceiling on damage.

In 2026, Self-Custody Is Failing at Three Layers

Placing this year's incidents side by side shows that self-custody is failing in places other than where the industry has been looking.

The first layer is the supply chain of key generation. In the Coldcard incident that began on July 30, a build configuration error introduced in a March 2021 firmware release caused seed generation to fall back on a software pseudorandom number generator rather than the device's hardware random number generator. Effective key strength reportedly collapsed from a designed 128 bits to as little as 40 bits on older devices. According to Galaxy Research, 1,082.65 BTC, worth roughly 70.2 million US dollars at the time (about 11.2 billion yen at 160 yen to the dollar), was swept from 1,196 addresses in 41 minutes on July 30 alone. Cumulative movement is put at roughly 1,816 BTC, about 116 million dollars (roughly 18.6 billion yen), across more than 5,200 addresses, with estimates varying by source. DeFiLlama's tally attributes about 46 percent of July's total 247.4 million dollars in crypto theft to this single incident. The devices were offline. The assets left anyway.

The second layer is the supply chain of purchase records. This is where the Trezor and Ledger incidents sit. What leaks here is not the asset but the real name and location of someone likely to hold one.

The third layer is physical attack using that information. Chainalysis recorded 46 violent crypto-related incidents globally through late June 2026, against 40 at the same point in 2025. CertiK estimates losses from physical coercion at 124 million dollars (roughly 19.8 billion yen) in the first half of 2026.

What stands out is the falling success rate. Chainalysis reports that only 12 of 46 incidents, or 26 percent, resulted in a transfer of funds in 2026, down from 49 percent (47 of 95) in 2025 and 67 percent (32 of 48) in 2024. The firm attributes the decline substantially to France, where a compromise of tax agency records expanded the targetable victim population considerably, making attacks more numerous and more indiscriminate and therefore less often successful than the intelligence-driven attacks of prior years.

Put differently, a leaked address list does not only make attacks more precise. It also induces cruder, more numerous attacks. The falling success rate is not an improvement in conditions but the reverse side of a widening base of victims.

From "Who Holds the Key" to "Who Knows You Hold It"

The self-custody debate has long turned on a single question: who holds the key. Leave assets with an exchange and you bear the risk of its failure or misconduct; hold them yourself and you avoid that.

The operative threat in 2026 sits outside that framing. The act of purchasing a hardware wallet functions as a signal that the buyer probably holds meaningful assets. A dataset joining that signal to a real name, street address and phone number is an unusually high-quality target list for an attacker. And that dataset is held not by the wallet vendor itself but by payment processors and fulfillment partners, firms that sit outside the crypto industry altogether.

Trezor's stated response is instructive. Alongside recommending anonymous email addresses, payment in crypto and the use of a P.O. box, the company said it aims to offer an anonymous delivery option combining a dedicated checkout, locker pickup, neutral packaging, generic sender details and automatic deletion of shipping identifiers after delivery, targeting the European Union in September 2026 and the United States by the end of the year.

This is not merely remediation but an attempt to build privacy protection into the product specification. Shipping physical goods worldwide makes it impossible to eliminate data sharing entirely. Given that, the only remaining levers are the quantity of information shared and the length of time it is held. The axis of competition is shifting to exactly there.

Business Development Insights

1. Treat data retention periods as a parameter that caps damage, not as a compliance line item. What limited this exposure to roughly 13,689 people was neither cryptography nor a security product but a policy of deleting or anonymizing data ninety days after delivery, contractually extended to fulfillment partners. In any business handling customer data, shortening retention is among the highest-return risk reduction measures available. It is worth auditing, from a risk management rather than legal perspective, whether your retention period is set to the genuine minimum operational window and whether that condition actually binds your vendors.
2. Extend vendor inventories beyond system integrations to logistics and payment processing. Both customer data exposures this year originated not with the wallet vendors but with a shipping provider and a cross-border e-commerce and payment platform. However strong an organization's own security posture, information must be handed outside to deliver an order, so the attack surface scales with the number of vendors. For financial institutions and corporates handling digital-asset-related physical goods, or any service involving delivery to customers, the practical starting point is to enumerate what data each vendor holds and for how long, and to confirm that deletion obligations are written into the contract.
3. Change the incident response triage criteria for personal data of likely crypto holders. Ordinary personal data breaches are assessed against risks of impersonation and financial fraud, but exposure of the address and phone number of a customer presumed to hold crypto assets translates directly into risk of physical harm. Losses from physical coercion in the first half of 2026 are estimated at around 124 million dollars, with home invasions rising as a share of incidents. In Japan as well, hardware wallets are now being distributed in connection with corporate service offerings, meaning the names and business addresses of corporate treasury staff could appear on comparable lists. Breach notifications should include warnings about physical security, not only phishing, and the criteria for making that call should be settled in peacetime.

Sources

• Trezor (SatoshiLabs), "Recent customer data exposed in shipping provider incident" (August 13, 2026) https://trezor.io/blog/news/recent-customer-data-exposed-in-shipping-provider-incident
• Trezor privacy and data storage policy https://trezor.io/support/logistics/orders-payments/privacy-policy-at-trezor
• CoinDesk, "Crypto wallet firm Ledger faces new data breach through Global-e partner" (January 5, 2026) https://www.coindesk.com/markets/2026/01/05/crypto-wallet-firm-ledger-faces-data-breach-through-global-e-partner
• SiliconANGLE, "Ledger confirms leak of customer data from third-party Global-e hack" (January 5, 2026) https://siliconangle.com/2026/01/05/ledger-confirms-leak-customer-data-third-party-global-e-hack/
• TRM Labs, "The Largest Hardware Wallet Exploit of 2026: Inside the USD 116 Million Coldcard Hack" https://www.trmlabs.com/resources/blog/the-largest-hardware-wallet-exploit-of-2026-inside-the-usd-116-million-coldcard-hack
• The Hacker News, "Coldcard Hardware Wallet Flaw Linked to $70 Million Bitcoin Theft in 41 Minutes" https://thehackernews.com/2026/08/coldcard-hardware-wallet-flaw-linked-to.html
• Fortune, "Bitcoin owners rocked by $116 million hack: What we know about the Coldcard exploit" (August 3, 2026) https://fortune.com/2026/08/03/bitcoin-owners-116-million-hack-coldcard-coinkite-exploit/
• Chainalysis, "Violent Wrench Attacks Targeting Crypto Holders" (2026) https://www.chainalysis.com/blog/violent-crypto-wrench-attacks-2026/
• Yellow.com on CertiK Intel3D data, "Physical Crypto Attacks Hit $124M In H1 2026, A Record High" https://yellow.com/research/crypto-physical-attacks-surge-wrench-season-2026
• CoinDesk, "Inside the rise of wrench attacks against crypto holders and how France has become the focus" (April 19, 2026) https://www.coindesk.com/business/2026/04/19/inside-the-rise-of-wrench-attacks-against-crypto-holders-and-how-france-has-become-the-focus