Attacks on wallets

Attackers rarely break a hardware wallet. It is expensive and slow. It is far easier to persuade the owner to hand over the keys – by email, a fake app, a phone call or, in the worst case, by force.

Phishing after data leaks#

Wallet manufacturers and the shops that sell for them have had customer data leaks:

• Ledger (2020) – the names, phone numbers and postal addresses of about 272,000 customers leaked.
• Trezor (2024) – attackers got into the customer support system and the contacts of about 66,000 people.

The wallets themselves were not at risk. But people on the leaked lists received convincing emails and text messages: "security incident, verify your seed phrase", "update your device at this link". The rule from the whole course applies here too: no honest party ever asks for your seed phrase, ever.

When buying a wallet, consider delivery to a pickup point instead of your home address.

Fake apps and websites#

• Fake apps in app stores and fake browser extensions that look like the official ones.
• Search ads that lead to a copy of the manufacturer's website.

Defence: download apps only via a link from the official website; type the website's address by hand or keep it in your bookmarks.

SIM swap#

In an attack called a SIM swap, an attacker persuades your mobile operator to assign your number to their SIM card. Your text messages then go to them – including codes for resetting your exchange password.

• For two-factor authentication use an app or a security key, not SMS.
• Set a PIN or password with your operator for changes to your number.
• On an exchange, turn on the withdrawal address whitelist if it offers one.

Physical extortion#

The darkest form is violence. It is called a wrench attack – after the joke that you cannot break the cryptography, but you can intimidate the owner. In January 2025 a co-founder of Ledger was kidnapped in France, and the kidnappers demanded a ransom in crypto. Similar cases became more frequent in the following months.

The defence rests mainly on staying low-key:

• do not brag – neither on social media nor in the pub,
• do not show balances and addresses linked to your name,
• keep large savings so they cannot be reached instantly – for example multisig with keys in different places, so moving them needs several places or people.

Common myths#

• "The email is from the manufacturer, it has its logo and my name." After data leaks, attackers have both.
• "An SMS code is enough security." A number can be moved to another SIM card.
• "Nobody will come for me, I am not a millionaire." Attackers often target whoever brags, not whoever has the most.