CZ Says Software Wallets Avoid Risks Seen in Trezor Leak
Trezor's data breach highlights how software wallets mitigate physical address risks.
1Trezor's Data Breach
On August 13, Trezor disclosed a data breach at its logistics partner ShipMonk, exposing the personal information of approximately 13,700 customers. The breach included sensitive details such as names, phone numbers, and home addresses. ShipMonk notified Trezor of unauthorized access to its systems on August 10. This incident has reignited concerns about the risks associated with hardware wallets.
2CZ's Defense of Software Wallets
Binance founder Changpeng Zhao (CZ) argued that Trezor's data breach highlights an advantage of software wallets. Unlike hardware wallets, software wallets do not require shipping a physical device, thus avoiding the linking of user identities to home addresses. CZ cited examples like Binance Web3 Wallet and Trust Wallet to illustrate how software wallets mitigate this risk.
3Criticism of Hardware Wallets
While CZ did not dismiss hardware wallets entirely, he emphasized their different risk profiles. He also noted that YZiLabs invests in several hardware wallet companies. NaoX Protocol warned that leaked addresses could provide attackers with a list of verified crypto holders. Bitcoin security expert Nick Neuman cautioned that the data could lead to targeted social engineering attacks.
4Trezor's Warnings
Trezor warned that customers could face more sophisticated phishing attacks via email, phone calls, or letters. The company urged users never to enter their wallet backup online or share it with anyone. These warnings aim to enhance user security in the wake of the breach.
5A Tough Period for Hardware Wallets
Trezor's data breach marks a challenging period for hardware wallets. In mid-July, investigator ZachXBT criticized hardware wallets as unsuitable for serious use, citing issues like dead batteries, forced firmware updates, and interface bugs. These criticisms have raised questions about the reliability of hardware wallets.
6Galaxy Research's Findings
Last week, Galaxy Research linked over $100 million in stolen Bitcoin to a flaw in older Coldcard firmware. The issue caused wallet seeds to be generated with weaker randomness than intended. Coinkite has patched the flaw in newer releases but cannot fix seeds already generated on affected devices.
7Trezor's Past Breaches
This is not Trezor's first data breach. In January 2024, a breach linked to a third-party support vendor exposed the contact details of around 66,000 users. These incidents highlight the security challenges Trezor faces when working with third parties.
8Conclusion and Significance
Trezor's data breach underscores the risks associated with hardware wallets and how software wallets mitigate them. This incident emphasizes the need for crypto users to reassess their security measures. Both hardware and software wallets have distinct risk profiles that users must consider.