Four hardware wallet manufacturers — Ledger, Trezor, SafePal, and Keystone — have disclosed customer data breaches in 2026, exposing shipping addresses and purchase records of nearly 120,000 buyers. The breaches share a common vector: third-party vendors in the e-commerce and fulfillment stack, n...
"The risk that becomes real when you leak people's shipping information is not phishing." — Taylor Monahan, Security Researcher
Four hardware wallet manufacturers — Ledger, Trezor, SafePal, and Keystone — have disclosed customer data breaches in 2026, exposing shipping addresses and purchase records of nearly 120,000 buyers. The breaches share a common vector: third-party vendors in the e-commerce and fulfillment stack, not the wallet devices themselves. None compromised private keys or seed phrases. All compromised something arguably more dangerous in the current threat environment: proof that a specific person, at a specific address, owns cryptocurrency.
CertiK documented 52 verified physical attacks against crypto holders in H1 2026, a 33% increase year-over-year, with estimated losses of $124.1 million. Home invasions — which numbered just one in H1 2025 — surged to 20 cases. The hardware wallet data breaches provide precisely the intelligence that enables this category of attack: a name, an address, and confirmation of crypto ownership.
Ledger — January 2026. Blockchain researcher ZachXBT revealed that customer data had been accessed through a breach at Global-e, a third-party payment processor used by Ledger's online store. The incident echoed Ledger's larger 2020 breach, which exposed 273,000 customer records and continues to generate fallout. In 2026, scammers sent physical letters to addresses sourced from the 2020 database, requesting seed phrases under the guise of a "security upgrade." Ledger holds approximately 34% of the global hardware wallet market and has shipped over 8 million devices since 2014, according to company disclosures.
Trezor — August 13, 2026. Trezor confirmed a breach at ShipMonk, a third-party fulfillment partner, exposing personal data of 13,689 customers across seven countries including the US, UK, Sweden, Colombia, Brazil, Italy, and Portugal. Compromised data included phone numbers and physical addresses of 11,742 individuals. Trezor holds approximately 28-30% of the global hardware wallet market, according to Intel Market Research.
SafePal — August 16, 2026. An authorization vulnerability in a third-party order tracking plugin exposed names, email addresses, phone numbers, shipping addresses, and purchase details for 39,798 customers who placed orders between March 2, 2025 and April 11, 2026. SafePal stated no seed phrases, private keys, or wallet passwords were involved.
Keystone — October 20-26, 2026. Keystone detected unauthorized access to its official website on October 20, confirmed the breach on October 23 after reviewing API activity with Shopify, and disclosed publicly on October 24. The breach exposed 25,964 buyer records, some retained past Keystone's own 180-day deletion policy after an automated purge tool failed without detection. A separate vector in the same incident compromised a device authentication key, forcing Keystone to destroy 18,835 unsold hardware wallets in inventory and pause all unshipped orders. According to CoinDesk, the destroyed inventory represented the company's entire unsold stock at the time.
Combined exposure: approximately 120,000 customers across four manufacturers in 2026.
None of the four breaches penetrated the wallet hardware or firmware. All originated in the commercial infrastructure surrounding device sales: payment processors, fulfillment warehouses, order tracking plugins, and e-commerce platform APIs.
This pattern mirrors broader findings in the crypto security space. A webthreepedia report published October 30 documented how supply chain attacks now exceed smart contract exploits in total losses. The hardware wallet breaches represent a specific subset of this trend: the attack surface has shifted from the cryptographic layer to the operational layer.
The vendors involved — Global-e, ShipMonk, unnamed analytics and order-tracking services — operate in the traditional e-commerce stack. They were not built to handle the security requirements of a customer base that faces physical threat from data exposure. A shipping address leak at a consumer electronics company is a regulatory compliance issue. A shipping address leak at a hardware wallet company is a physical safety issue.
Keystone's breach revealed an additional vulnerability: the company retained 25,964 customer records beyond its stated 180-day deletion policy because an automated deletion tool failed silently. The incident underscores that data minimization policies are only as reliable as the systems implementing them.
CertiK's H1 2026 report, published July 25, documented a sharp escalation in physical attacks against crypto holders:
| Metric | H1 2025 | H1 2026 | Change | |--------|---------|---------|--------| | Verified incidents | 39 | 52 | +33% | | Estimated losses | ~$10.5M | $124.1M | +1,082% | | Average loss per incident | ~$270K | $2.39M | +785% | | Home invasions | 1 | 20 | +1,900% |
France accounted for 33 of 52 global incidents (63.5%), more than double the count in the United States. CertiK attributed France's concentration to a combination of a visible crypto ecosystem and major data breaches at government agencies (ANTS and France Travail) that cross-referenced crypto holder identity with address data.
Chainalysis separately estimated that wrench attacks stole over $30 million through 46 documented attempts in 2026 through mid-year, putting the year on pace to surpass the $58 million stolen through physical attacks in 2025.
The attack methodology is evolving. According to CertiK, criminals are adopting "more sophisticated data-driven targeting, proxy and family coercion, and organized transnational models." Home invasions replaced street robberies as the dominant pattern, requiring advance intelligence on where victims live — precisely the data leaked in hardware wallet breaches.
The connection between hardware wallet shipping data and physical attacks is not theoretical. The data required to execute a wrench attack consists of three elements: identity (a name), location (a home address), and confirmation of crypto ownership (proof the target holds digital assets). A hardware wallet shipping record provides all three in a single row.
The Ledger breach of 2020 offers a longitudinal case study. Six years after the initial exposure, scammers are still using the leaked addresses to mail physical letters requesting seed phrases. The data does not expire. According to security researcher Taylor Monahan, the physical risk created by leaked shipping data exceeds the phishing risk — a home address linked to crypto ownership becomes a permanent targeting vector.
The hardware wallet market generated approximately $720-914 million in revenue in 2026, according to market research estimates, growing at 25-34% CAGR. Ledger and Trezor together control over 60% of global sales. This means the majority of hardware wallet customers in the world rely on a supply chain that has now been breached multiple times across multiple vendors.
The hardware wallet industry's core value proposition is security. The 2026 breach pattern undermines not the cryptographic security of the devices — which remains intact — but the operational security of the purchase and delivery process.
Keystone's response offers a measure of the economic cost. The company destroyed 18,835 devices in inventory, representing its entire unsold stock, and paused all unshipped orders. The financial impact of destroying inventory and halting sales operations has not been publicly quantified, but for a smaller manufacturer competing against Ledger and Trezor, the disruption is material.
The broader hardware wallet market has not seen measurable demand destruction from the breaches, according to available sales data. This suggests either that buyers discount the vendor-layer risk, that they lack alternatives, or that the connection between data breaches and physical violence is not yet widely understood by retail purchasers.
The 2026 hardware wallet breach pattern reveals a structural vulnerability in the crypto self-custody ecosystem. The devices work. The cryptography works. The e-commerce stack that delivers them to customers does not meet the threat model those customers face.
The industry's standard response — "no private keys were compromised" — is accurate but incomplete. In a threat environment where home invasions against crypto holders increased 1,900% in one year, the exposure of a shipping address paired with proof of crypto ownership constitutes a distinct and serious harm.
No hardware wallet manufacturer has announced plans to fundamentally restructure its fulfillment and e-commerce operations in response to the breaches. Keystone's destruction of compromised inventory addresses the device authentication issue but does not prevent future shipping data exposure. Ledger's 2020 breach data continues to circulate six years later.
The gap between the cryptographic security of hardware wallets and the operational security of their supply chains represents an unresolved risk for the estimated 10+ million hardware wallet owners worldwide.
The hardware wallet industry sells cryptographic security but delivers it through a standard e-commerce supply chain that was not designed for customers who face physical violence as a consequence of data exposure. The 2026 breaches did not compromise a single private key. They compromised something the industry's security model does not account for: the physical safety of buyers.
Until hardware wallet manufacturers restructure their fulfillment operations to match the threat model their customers actually face — or until the industry develops purchase and delivery methods that do not require linking a buyer's identity and address to proof of crypto ownership — the gap between device security and supply chain security will remain the defining vulnerability of crypto self-custody.