Target: SatoshiLabs (Trezor)
Date: August 2026
Threat Actor:ShinyHunters (via third-party vendor compromise)
Attack Vector: Third-Party Supply Chain & Analytics Platform Zero-Day (Metabase SQL Injection)
Impact: Over 81,000 customer shipping records leaked and a subsequent wave of targeted phishing affecting 347,000 users
The Crack
Unenforced Data Deletion and Third-Party Vendor Exposure
Hardware wallet providers can maintain air-tight internal security, but they rely on third-party logistics and fulfillment partners to ship physical devices globally. When fulfillment vendors fail to purge historical customer order records in line with strict data-retention policies, a single vendor breach turns into a goldmine for attackers hunting crypto owners.
The Execution
- Vendor Reconnaissance: Extortion gangs targeted ShipMonk, a third-party logistics provider used by Trezor, and exploited a critical zero-day SQL injection vulnerability (CVE-2026-72898) in their internal Metabase analytics instance.
- Database Compromise: Leveraging administrative access gained through the analytics flaw, attackers extracted internal customer order databases stored by the fulfillment provider.
- Data Exfiltration: The breach exposed sensitive fulfillment data for over 81,000 customers—including full names, phone numbers, email addresses, and physical shipping addresses tied directly to hardware wallet purchases.
- Extortion & Secondary Campaigns: Following ransom demands, the actors leveraged leaked identity vectors to set the stage for downstream social engineering, coinciding with separate third-party marketing tool compromises that pelted hundreds of thousands of users with convincing hardware-vulnerability phishing lures.
The Blast Radius
- Physical Security Risks: Home addresses combined with known cryptocurrency hardware purchases create acute physical extortion and home-invasion risks for affected buyers.
- Mass Phishing Saturation: Downstream attacks utilized precise customer contact details to launch convincing, fear-driven campaigns (such as fake hardware vulnerability alerts) designed to trick users into divulging seed phrases.
- Reputational Friction: Even though Trezor’s core infrastructure and device firmware remained entirely uncompromised, the brand absorbed heavy reputational damage due to partner ecosystem vulnerabilities.
The Hardening Plan
- Enforce Contractual Data Deletion: Do not rely on written assurances alone; cryptographically or operationally verify that third-party logistics partners permanently delete or anonymize customer shipping data after the mandatory 90-day fulfillment window.
- Minimize Physical Footprint: Provide anonymous purchasing options, support cryptocurrency or disposable card payments, and encourage the use of alternative delivery locations or P.O. boxes to decouple home addresses from hardware wallet orders.
- Strict Third-Party Surface Management: Continuously audit the security posture, internal analytics instances, and software supply chain dependencies of all external vendors handling customer data.”