In the past thirty days, a single SQL injection vulnerability exposed the home addresses of a quarter of a million crypto hardware wallet customers. Since that data started circulating, physical attacks on crypto holders have accelerated at a pace that has no precedent in the industry’s history. The connection between these two facts is not coincidental. It is a blueprint — and it is being followed in real time.
The crisis playing out in August 2026 is not primarily a story about code. It is a story about what happens when verified proof of crypto ownership gets attached to a home address and handed to criminals.
The Breach: 253,487 Names and Addresses
Three separate incidents, one underlying vulnerability, and a combined exposure of 253,487 customers. That is the scale of the hardware wallet data breach wave that came to light in August 2026.
The technical root cause is CVE-2026-72898: a critical SQL injection flaw in Metabase, a popular business intelligence and order-tracking platform, rated CVSS 10.0 — the maximum severity score. According to vulnerability assessments published after the advisory, over 97% of fingerprinted hosts on affected Metabase branches were unpatched when the disclosure went public. That is not a fringe oversight. That is a systemic failure across an entire software ecosystem.
The victims span three companies. Trezor, one of the most trusted names in hardware wallet security, confirmed that 13,689 customers had their names, email addresses, phone numbers and shipping addresses exposed via its logistics partner ShipMonk. The exposure window ran from May 10 to August 8 — nearly three months. Trezor’s announcement on August 14 marked the company’s first breach involving home addresses and phone numbers in its thirteen-year history. SafePal suffered a separate breach via an authorisation flaw in its order-tracking plugin, exposing 39,798 customers. And Israeli crypto exchange Bits of Gold — hit by the same CVE-2026-72898 — exposed approximately 200,000 customers, including Israeli national ID numbers and public wallet addresses alongside shipping details.
The wallet devices themselves were not compromised. The seed phrases were not stolen. But that distinction matters less than it might appear, because the data that was stolen is sufficient to enable something far more direct than a software exploit.
Wrench Attacks: The Offline Threat That Numbers Can’t Ignore
A “wrench attack” is industry shorthand for a physical robbery targeting a crypto holder — named for the oldest tool in the coercion arsenal. The attacker knows you hold crypto. They know where you live. They show up and apply pressure — physical, immediate, and effective in a way that no cryptographic protocol can prevent — until you hand over your seed phrase.
In the first half of 2026, there were 52 verified wrench attacks globally. That is a 33% increase over the 39 recorded in H1 2025, which was itself a record year. But the financial exposure tells the more alarming story: $124.1 million in H1 2026, compared to $10.5 million in the same period of 2025. That is an eleven-fold increase in value extracted in twelve months. The average successful attack now yields approximately $2.4 million.
The method has also escalated. Home invasions — attackers entering victims’ residences — numbered 20 in H1 2026, up from just 1 in H1 2025. Kidnappings rose from 12 to 16. The geographic concentration is stark: France accounts for 33 of the 52 global incidents, 63.5% of all verified attacks, with 41 crypto-linked kidnappings recorded across 2026 at a rate of roughly one every 2.5 days. French authorities have flagged the situation as a national security concern.
The operational logic is straightforward. Before the Trezor, SafePal and Bits of Gold breaches, identifying a high-value crypto holder at a known home address required significant intelligence work. After the breaches, that work was done. The data — name, address, phone number, purchase history of a hardware wallet — is verified proof that someone at a specific address owns crypto and takes it seriously enough to buy dedicated hardware for it. That is exactly the profile criminals are looking for.
The Coldcard Parallel: When the Hardware Itself Fails
The data breach wave is not the only hardware security story of August. Running in parallel is the ongoing fallout from the Coldcard firmware exploit — a vulnerability in code dating to 2021 that allowed attackers to predict supposedly random seed phrases generated offline. Over $130 million was stolen before the exploit was identified and patched.
One victim, who asked not to be identified, described the disorientation of losing funds despite doing everything correctly: “I followed every protocol. Air-gapped device. Never connected to the internet. Seed phrase stored offline. None of it mattered — all because the hardware that created the seed phrase originally had one line in their code from 2021 that had a vulnerability.”
The Coldcard exploit and the shipping data breaches represent two entirely different attack surfaces converging on the same conclusion: the hardware wallet security model, as most users practice it, has gaps that are only becoming apparent as adversaries grow more sophisticated. One gap is in the device firmware. The other is in the supply chain data that surrounds the device from the moment it is ordered.
The Industry Response: Too Little, Too Late?
The response from affected companies has been measured but does not match the scale of the problem. Trezor announced an “Anonymous Delivery” service — allowing customers to purchase without providing a home address — launching in the EU in September 2026 and in the US by year-end. SafePal reduced its data retention policy to 90 days post-breach. Both companies warned affected customers about phishing attempts using the exposed phone numbers and email addresses.
These are reasonable measures. They are also reactive. The data from the current breaches already exists in criminal hands. Anonymous Delivery protects future customers; it does nothing for the 253,487 people whose addresses were exposed between May and August.
The broader industry is beginning to respond with its own resources. Coinbase disclosed in its most recent annual report that it spent $8.7 million on physical security measures for employees and executives — a figure that reflects how seriously the largest centralised exchange takes the physical threat to its own people. That budget is not available to the retail holder sitting at home with a Trezor and an address now circulating on criminal databases.
What Holders Should Do Now
If you purchased a Trezor, SafePal, or Bits of Gold product between May and August 2026, assume your data was exposed. The practical steps are not complicated, but they need to happen urgently.
Physical security awareness. The exposed data makes you a potential target for physical approaches. Be alert to strangers asking questions about your crypto holdings, unsolicited visitors, or unusual surveillance of your home. This sounds extreme; the H1 2026 statistics justify the caution.
Phishing vigilance. Your phone number and email address are now potentially in criminal hands. Do not respond to any unsolicited contact claiming to be from Trezor, SafePal or any crypto service. All legitimate communication from these companies will be through official channels you initiate.
Seed phrase location. Your seed phrase should not be stored anywhere near your primary residence if your address has been exposed. Consider whether your current storage arrangement assumes a level of obscurity that no longer exists.
Wallet migration. If you own a Coldcard and have not updated your firmware and generated a fresh seed phrase on patched hardware, this remains urgent. The exploit targeted seed phrases generated on vulnerable firmware — a migration to a new wallet removes that exposure.
The Structural Problem
The deeper issue that August 2026 is exposing is not fixable with a firmware patch or a new delivery policy. The hardware wallet industry built its security model around protecting the private key. It did not build an equivalent model around protecting the identity of the private key holder.
As one security researcher put it bluntly after the breach disclosures: “Every day a record exists beyond its operational purpose is a day it can be stolen.” The Metabase vulnerability that enabled CVE-2026-72898 was sitting in production systems, on data that had no business being retained, for months. The 97% unpatched rate is not a Trezor or SafePal problem — it is an industry-wide data hygiene problem that the wrench attack statistics are now pricing in real time.
The lesson of August 2026 is that crypto security is not just about what happens on-chain. The off-chain data trail — who bought what, from where, delivered to whom — is now as important to protect as the seed phrase itself. The criminals have figured this out. The industry is catching up.
Sources: TechCrunch · The Register · Crypto.news
Crypto, IT & Cloud 