Yesterday Trezor confirmed a data breach exposing customer order details; in this video I share what happened, what it means, and the self-custody best practices worth tightening.
In light of the “self-custody is dead” campaign, I discuss one of Bitcoin’s first principles: removing trusted third parties, not scaring you into adding them back in.
Please like, comment, share & follow — to help me beat the suppressing algo’s. Thx!
Transcript:
PART 1: THE TREZOR INCIDENT
Yesterday Trezor confirmed a data breach at one of its shipping partners, exposing customer order details, and in this video I’ll walk through what happened, what it means, and the self-custody best practices worth tightening.
But first we need to talk about what’s happening to self-custody, because I feel there’s a multi-front attack on bitcoin and specifically on self custody, and the last couple of weeks make that hard to ignore.
That matters because self-custody isn’t a fringe practice, more than 45% of bitcoin is held in self-custody today, according to River. And I think that’s exactly why there’s a real push to reduce that number and get users custodying their bitcoin with third-party custodians instead, because the more that shifts, the more it chips away at bitcoin’s strength as a permissionless asset. And yet, look at what’s piled up in just the last couple of weeks.
It started with Coldcard, a firmware flaw that quietly weakened seed randomness, draining over 1,800 Bitcoin from thousands of addresses. Then BTCPayServer, exploited to empty Lightning nodes. Then Boltz, hit by relentless AI-assisted attacks until its founding team stepped down and handed the company off, and days later Lightning wallet ZEUS pulled its own infrastructure offline after a separate cyberattack. And now, this week, Trezor disclosing a shipping partner breach that exposed customer data.
All of this landed right around Bitcoin’s contentious BIP-110 activation window. I’m not saying that’s cause and effect, but five incidents in the same stretch of weeks is not something to wave off as coincidence. It reads like a multi-front attack on the credibility of self-custody itself, and headlines are pushing the same message: self-custody is dead, you can’t trust yourself to custody your own money, you need someone else to hold it for you.
But I reject that framing. It may not be for everyone, and some people genuinely need help, but it’s still a valid approach. There are many ways to hold, secure, and transact with Bitcoin, and each person, business, or institution should use whatever fits them best.
I also think we’d be lying to ourselves if we didn’t admit these incidents are teaching us something real. We’ve gotten comfortable, and that’s exactly where security fails. So instead of getting defensive, let’s actually learn from this and tighten what needs tightening.
Here’s what Trezor disclosed.
Trezor put out an official statement on August 13th about a breach at ShipMonk, one of the shipping providers they use to fulfill orders. An unauthorized party gained access to systems holding customer data. The exposed KYC information includes names, phone numbers, emails, and shipping addresses, of roughly 14,000 people who ordered from the US, UK, Sweden, Colombia, Brazil, Italy, or Portugal between May 10th and August 8th 2026. If you placed an order during that time, check your email to see if you received a message from help@trezor.io about it.
The reason the number isn’t higher is Trezor’s own data retention policy. They retain order data for only 90 days after delivery, and require the same from their shipping partners, so anything older simply wasn’t there.
Trezor also says this is the first time in their thirteen-year history that a breach has exposed customer phone numbers and shipping addresses.
Important to mention, as I’ve seen some people and companies spreading misinformation about it: devices and wallets were NOT affected by this. This is an order data breach, which poses an operational security risk, not a funds risk. Nobody’s Bitcoin was touched, no private key was exposed, and Trezor’s own systems were not compromised. This was strictly a data breach.
PART 2: SELF-CUSTODY BEST PRACTICES
So let’s get into the actual takeaways here, a few self-custody best practices worth tightening up right now.
If you were affected, know this: it doesn’t put your funds at risk directly, but it does put you at risk of phishing, and since shipping addresses were exposed, it also raises the risk of a $5 wrench attack, meaning physical targeting based on someone knowing where you live and that you own a hardware wallet. Whoever accessed this data now has exactly what they need to send convincing phishing emails, fake calls, fraudulent letters impersonating Trezor, your bank, or an exchange.
Never enter your seed phrase anywhere but your device. Not a website, not an app, not a support chat. This is the single most repeated piece of advice from every hardware wallet company after every incident, because it’s still the number one way people actually lose funds.
Verify any Trezor communication through official channels only. No legitimate company will ever ask you for your recovery words, your seed phrase, not by email, not by phone, not on a website. Btw the same goes for communication from me or anyone else, there are so many impersonators who are trying to scam people pretending to be someone they’re not. I would never DM you to ask for your personal information.
Consider a multisig setup for meaningful amounts. Spreading trust across multiple devices or locations means a compromised seed can’t take everything. When it comes to multisig, remember it doesn’t necessarily require a custodian, it doesn’t require KYC, giving up your privacy, or a company signing on your behalf. One of Bitcoin’s first principles is removing trusted third parties, not scaring you into adding them back in under a different name.
Limit what companies know about you when you order. Use an email address that isn’t tied to your real identity when you place the order. Pay with bitcoin if you can, and if you can’t, use a disposable debit card instead of your regular one. Ship to a PO Box or delivery center, instead of your home address to limit how much of your physical location is on file, though keep in mind ID is usually still required to collect from one.
Trezor is also rolling out an anonymous delivery option, using locker pickup, neutral packaging, and generic sender details, with automatic deletion of shipping data after delivery, aiming for the EU by September and the US by the end of the year.
WHY THIS MATTERS
Lastly, I want to apologize for not stressing these best practices earlier, I’m aware it could have protected people from this data breach, and as someone who recommends Trezor products, I apologize if you got affected. I also want to emphasize something about every company or product I talk about on my show. Nothing is risk free. I bring you the people and the products I find compelling, but that is never a substitute for your own research. Always look into the security practices of anything you use to store or move your money, and always decide for yourself what level of risk you’re comfortable carrying.
Stay sharp, vigilant, and safe out there.
Connect with me:
Twitter | YouTube | Instagram | Nostr | My podcast | All other links
Latest content:
Freedom, Forged in Art - MADEX | Ep. 155
MADEX is an internationally renowned artist, designer and creative director from Alberta, Canada. He built the Bull Bitcoin brand alongside Francis Pouliot, and runs MADEX, a fine art, jewelry and regalia project he describes as a freedom project. In this rare conversation, MADEX explains why art has been captured as a vehicle for collectivist ideas and…
10 Years of BTC Sessions: Expanding Into Privacy, Sovereignty & Freedom Tech - Ben Perrin | Ep. 154
*Note that this episode was recorded before the coldcard hack.
Trezor's CTO on the Cold Card Hack: Randomness, Trust, and What Comes Next - Tomáš Sušánka | Ep. 153
Tomáš Sušánka is the CTO of Trezor, where he has worked since 2017. Tomáš joins Efrat for an urgent, unscripted conversation days after the Cold Card hardware wallet hack, in which a flawed random number generator left seed phrases vulnerable and resulted in more than 1,500 bitcoin stolen from affected users. Drawing on questions submitted directly by t…
A 30-Year Cypherpunk Exposes The Crimes of Global Proportions - Paul Rosenberg | Ep. 152
Paul Rosenberg is a cypherpunk author and cryptography advocate who has been in the movement since finding the original cypherpunk circles in 1995. Cryptography pioneer, author of 80 books, multiple newsletters, co-founder of Cryptohippie. He wrote A Lodging of Wayfaring Men
Urgent: Coldcard (Bitcoin Hardware Wallet) Users Need to Move Their Coins, Here’s What Happened
If you or anyone in your circle uses a Coldcard hardware wallet, please read & share this.
The Sovereign Individual / Efrat’s BTC Prague Keynote | Ep. 151
My BTC Prague keynote speech just dropped.
Canada's Captured Government & the Fight for Alberta - Dave Bradley | Ep. 150
Dave Bradley is a Bitcoin OG and entrepreneur based in Calgary, Alberta. He co-founded Bull Bitcoin, and helped take Bitcoin Well public. He’s an outspoken advocate for Alberta independence, arguing that the breakup of the Canadian confederation and Bitcoin are two expressions of the same underlying shift toward sovereignty and jurisdictional competitio…
Sponsors:
Expat Money
→ Download the free report on second citizenships & setting up a plan B in another country with Expat Money: https://expatmoney.com/efrat
Watch my episode with Mikkel for more:
Ledn
→ Access liquidity without selling your Bitcoin, get 0.25% off your first loan: https://ledn.io/Efrat
Trezor
→ Get your TREZOR wallet & accessories, with a 5% discount, using my code at checkout (get my discount code from the episode - yep, you’ll have to watch it)
Abundant Mines
→ Have you tried mining bitcoin? Stack sats directly to your wallet while saving on taxes with Abundant Mines. A month of free hosting for my followers:
Special offers:
→ Get 15% off “Born To Be Free” all-natural, tallow-based skincare products on a bitcoin standard, using code EFRAT: https://oshi.link/1nvZYq
→ Join me at any of these conferences or events:
→ Get 10% off on Augmented NAC to detox the Spike protein, using the code: YCXKQDK2, and this link. (Please note, this is not medical advice and you should consult your MD). Watch the episode with Tina below.
→ Watch “New Totalitarian Order” conference with Prof. Mattias Desmet & Efrat - use code EFRAT for 10% off
— Support my work —
I was recently banned from Stripe, so I cannot have paid memberships on Substack… but there’s always another way!
