Hardware wallet after the data breach: four ways to order without a home address

A hardware wallet protects your keys reliably. It does not protect your home address. The short answer to getting both at once: have the device delivered to a parcel locker, a post office branch or another pickup point, or buy it over the counter in a shop. Your name then sits in the retailer's order database next to a locker number instead of next to your front door.

October showed that this difference is no quirk of the overcautious. Within a few months several providers in the custody business have conceded that customer data leaked. Not once did it involve keys or balances. Every time it involved names, phone numbers and delivery addresses of people for whom it is now on record that they own crypto assets.

Why the keys stay safe and the address leaks anyway

A hardware wallet is a small device that generates your private key and never hands it out again. The recovery phrase, that sequence of usually twelve or twenty-four words from which all keys can be recomputed, is created on the device and does not leave it in normal use. When you approve a transfer, the key stays on the device; only the finished, signed transaction travels to the computer. The retailer you bought the device from sees none of this, because technically it is not involved at all.

That leaves one reassuring fact and one uncomfortable one. The reassuring one: a break-in at a manufacturer's web shop cannot touch your balances. If your bitcoin has sat on such a device for years, a shop mishap means nothing to move and nothing to set up again. The uncomfortable one: the web shop itself is an ordinary online retailer with an ordinary customer database. It holds first name, surname, street, house number, city, country, often the phone number, the email address and the list of items ordered along with prices.

That combination is the problem. A stolen address list from a furniture store reveals that somebody bought a sofa. A stolen address list from a wallet maker's shop reveals that somebody keeps crypto assets at home, how expensive the model was and therefore roughly how serious they are about it. The data set is a shortlist an attacker would otherwise have to assemble laboriously.

Keystone and Trezor: where in the order chain the data sat

Keystone says it noticed the incident on October 20 and confirmed on October 23, after checking with its shop provider Shopify, that a third party had obtained customers' shipping information. The company made the case public on October 24, together with an apology. According to the firm, names, contact details, delivery addresses and order details down to items and prices are affected. Payment card data, bank details, recovery phrases, private keys and wallet passwords did not leak, it said. Keystone has not said to this day how many customers are affected. The particulars of this case are in our report on the confirmed data breach at Keystone.

At Trezor the leak sat one layer further out. The manufacturer announced on August 13 that data of 13,689 customers had been exposed after its logistics provider ShipMonk reported unauthorised access three days earlier. For 11,742 of those affected this covered name, delivery address, phone number and email address, and for a further 1,947 at least name, city and email address. It hit orders shipped between May 10 and August 8, among others to the United States, the United Kingdom, Sweden, Italy and Portugal. The more awkward half came in early September: the stolen files also contained old order data from an earlier collaboration in the years 2019 to 2021, around 67,000 further records in the United States alone. According to Trezor, that legacy data should have been deleted long ago under the contract. What those affected can do about it is written up in our piece on the Trezor leak.

Both times the finding is the same: the devices and the manufacturers' own systems remained untouched. What leaked was the chain that carries an order from the input form to the front door.

Shop platform, warehouse provider, analytics tool: who stands between maker and letterbox

Order a device online and you have a business relationship with exactly one company. Your data, though, passes through several. First comes the shop platform the store runs on at all; Keystone names Shopify here, and Shopify was already at the centre of the largest case of this kind to date back in 2020. Names, email addresses, postal addresses and phone numbers of around 272,000 Ledger customers were published then, a figure the company later corrected to about 292,000 because Shopify reported further victims. The data surfaced in a hacker forum in December 2020, together with more than a million email addresses. Neither keys nor balances were affected that time either, and that was of little help to those concerned: at least one buyer later reported moving house after threats.

Then there is the warehouse and shipping provider that packs the goods and hands them over. It needs the full address, or it cannot deliver anything. In ShipMonk's case, a third layer came into it according to the notification letters seen by the trade outlet BleepingComputer: the attackers exploited a weakness in the analytics tool Metabase, software the provider uses for its own figures. The buyer of a hardware wallet has never heard of that software, and yet their data lay within its reach.

The pattern is therefore easy to describe. The longer the chain between order and letterbox, the more places hold the same address, and the more contracts stand between you and the company that eventually loses it. No manufacturer can guarantee that every link in that chain works cleanly. You can, however, make sure the address running through the chain is not the one where you sleep.

Four ways to order, and what each one tells the retailer

All four routes cost the same for the device itself. What differs is only the data set left behind at the end. The first runs via a pickup station, the second via a branch of the delivery firm, the third via buying in a shop, and the fourth does without a physical device. All four are readily available in Germany, and none asks you to misrepresent yourself to the retailer or give false details. That would be neither necessary nor wise, because warranty and returns depend on correct data.

A parcel locker accepts the package without your home address

The most direct route is a pickup station. At DHL it is called the Packstation, and other carriers run pickup points under other names on the same principle: you get a customer number, enter the number of the station as the delivery destination and collect the parcel when it suits you. The retailer's database then holds your name, a post number and the address of a machine standing in a supermarket car park. An attacker who gets hold of that list knows you bought a hardware wallet, but not where you live.

For recipients there is no surcharge, and registration runs through the carrier's customer account. Two limitations come with it. First, your real address still sits with the carrier itself, because the customer account knows it; you are moving it from many places to one. Second, pickup stations have compartment sizes and storage deadlines, which with a device the size of a cigarette packet is rarely a problem.

Branch delivery and the post office: the route without an account at the carrier

If you would rather not register anywhere, you can have the parcel sent to a branch. The delivery address is then the branch's address plus your name, and you collect it with your ID. The data set at the retailer therefore looks just as harmless as with the pickup station, and you need no extra account. The price is opening hours and the occasional queue.

One variant is often overlooked in Germany: many carriers offer to redirect a shipment to a branch after the fact, as long as it is still in transit. That only helps so far, though, because by then the retailer has long since stored your home address. For the purpose at hand, all that counts is what goes into the address field during the order.

Buying in a shop creates no delivery data at all

The cleanest route is the oldest. Buy the device over the counter at an electronics market or a specialist crypto retailer and pay cash, and you leave no delivery address, because no delivery takes place. One second trade-off comes with it, however, and it has been argued over for years: the question of whether a device off the shelf could be tampered with.

The manufacturers answer that with procedures anyone can inspect. Reputable devices check at first start-up whether their software is genuine, and they require you to generate the recovery phrase yourself on the device. A device that presents you with a ready-made phrase on an enclosed slip of paper is to be disposed of in any case, whether it came from a shop or from a parcel. Take that check seriously at first set-up and buying in a shop brings no additional danger into the house, while saving you one data set.

A software wallet needs no shipping but costs security

The fourth route bypasses the parcel altogether. A software wallet on the phone or the computer is downloaded, not delivered, and therefore produces no shipping data. For smaller amounts, for first steps and for balances used to pay regularly, that is a defensible solution.

The comparison stays honest only with the other side of it. The key there sits on a device that is online, opens files and runs extensions. Balances have disappeared through exactly such extensions over the past months. The choice between the two forms is therefore not a choice between safe and unsafe, but between two different risks: with a delivered device you risk your address becoming known. With the downloaded application you risk your computer being compromised. Anyone holding larger amounts usually accepts the first risk and shrinks it through the ordering route.

What the ordering route does not solve: payment data, invoice and warranty

A pickup station does not make you invisible. Three things stay with the retailer even then. The billing address, which with most payment methods is checked against the payment provider's data and therefore has to be correct. The email address, through which order confirmation and delivery status run. And the payment trail itself, from which name and bank can be derived depending on the method.

In practice that means this: if you do not want to hand over the billing address either, buying in a shop is the only way. If you can live with your name and billing address sitting at the retailer while the delivery address does not turn up in every logistics database, route one or two serves you well. Warranty and the right of withdrawal, incidentally, hang on none of these decisions; they apply regardless of where the goods went.

Your name is already out there: access requests under Article 15 GDPR

For everyone who ordered before October, the ordering route comes too late. Data protection law applies instead, and it applies to manufacturers outside Europe too, as long as they deliver to customers in the European Union. Two duties fall on the company of its own accord: under Article 33 of the General Data Protection Regulation it must report a data breach to the competent supervisory authority within 72 hours of becoming aware of it. Under Article 34 it must also notify those affected without delay once there is a high risk to their rights, in clear and plain language, with details of the nature of the breach, the likely consequences and the measures taken.

Added to that is a right you can exercise yourself. The right of access under Article 15 obliges the retailer to tell you which data it processes about you, where it got them, who it passes them to and how long it keeps them. That third question is the most interesting one after the recent cases, because it brings to light the chain of service providers never mentioned during the order. An informal email to the address in the legal notice is enough, and a one-month deadline is the rule.

Deletion and damages: what Article 17 and Article 82 deliver

The next step follows from the access request. Anyone who is no longer a customer can demand deletion of their data under Article 17; retention duties under commercial and tax law take precedence and concern invoices above all, not every marketing list. The cases of recent months show why that is more than paperwork. At Keystone, buyers came forward whose order dated back more than two years, although the company had held out the prospect of deletion after 180 days in its privacy policy. At Trezor, old orders from the years 2019 to 2021 sat in the stolen files, which according to the manufacturer should contractually have vanished long before.

That leaves the question of money. Article 82 gives those affected a claim to compensation for non-material damage as well. On November 18, 2024 the German Federal Court of Justice ruled, on a data scrape at Facebook, that even the mere and brief loss of control over one's own personal data can constitute such damage; the court does not require proven misuse or further tangible consequences for that. It did not name a fixed sum, however, and the loss of control has to be set out in the individual case. If you are considering it, keep the retailer's notification email, because it is the simplest evidence that your data sat in the affected set.

52 recorded attacks in the first half-year: the physical risk in numbers

Why a delivery address weighs more heavily than an email address can be quantified. The analytics firm CertiK counted 52 confirmed physical attacks on holders of crypto assets in the first half of 2026, after 39 in the same period a year earlier. Recorded financial exposure rose, by the same analysis, from $10.5 million to around $124.1 million. The distribution stands out: 39 of the 52 cases fell on Europe, 33 on France alone. The method has shifted too, with attacks inside the home rising from one recorded case to 20 and abductions from 12 to 16.

These figures need context, and CertiK supplies it itself. The total includes ransom demands and forced transfers as well as frozen or recovered assets, so it is not a statement about actual loot. At the same time the firm points out that such crimes are heavily under-recorded. For judging a leaked address list the core holds: whoever owns a list of households that with some probability hold crypto assets owns a shortlist. As a countermeasure CertiK recommends, among other things, splits in which a single person cannot dispose of the balance alone, such as a multisig wallet with several keys, plus delays on withdrawals and clear arrangements within the family.

The trick after every leak: fake recall and replacement-device emails

The most common consequence of an address leak is less spectacular and hits more people. Keystone itself warned that fraudsters pose as employees of the company and offer refunds or replacement devices. The pattern has been the same in this industry for years: a message arrives that describes the real incident correctly, names you properly, often names the model ordered too, and derives an urgent offer from it. A free replacement device, a supposed security update, a compensation form.

The counter-rule is short and admits no exception. No manufacturer and no retailer ever asks for your recovery phrase, not by email, not on the phone, not through a form, not for verification and not for a refund. Enter the words and you lose your balance the moment you hit send, finally, because a blockchain transfer cannot be recalled. A device sent to you unasked should be set aside unused and reported to the manufacturer. How such messages can be spotted in detail is in our guide to phishing after a data breach.

Ordering a wallet: the parcel locker costs no extra

Protecting your keys and protecting your address are two different jobs, and no device does the second one for you. Three steps are enough.

1. Change the delivery destination before you order the next device. A pickup station or a branch as the delivery address costs nothing and takes its most valuable data set away from the longest chain. Which device suits your holding period and your amount at all is in the hardware wallet comparison.
2. Skip shipping entirely for small amounts. What you move day to day needs no parcel. Which applications are up to it and where their limits lie is shown by the software wallet comparison.
3. Do not tie everything to one known address. Part of the holding at a supervised provider reduces what sits at home and brings a different risk you should know about; which houses in Europe hold a licence is in the overview of regulated crypto exchanges.

(As of October 26, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)