Hardware Wallets Under Siege: D’CENT and Trezor Incidents Expose the Hidden Vulnerabilities in Crypto Self-Custody

The promise of cold storage meets the reality of connected ecosystems, as two separate security events this week reveal that the weakest link in cryptocurrency protection may not be the device itself—but everything surrounding it.

In an unprecedented convergence of security failures, two of the cryptocurrency industry’s most trusted hardware wallet manufacturers have found themselves confronting a sobering reality: the fortress is secure, but the surrounding terrain is dangerously exposed. D’CENT, the South Korean hardware wallet giant, has launched an urgent investigation into unauthorized transfers affecting users of its software-based App Wallet, while European rival Trezor disclosed a significant data breach that compromised the email addresses of more than 347,000 customers through a third-party marketing vendor.

Neither company has reported any compromise of the actual hardware devices that have made these brands synonymous with impenetrable cryptocurrency storage. Yet both incidents have illuminated a troubling truth about the modern crypto security landscape: the recovery phrase—that critical string of words capable of reconstructing an entire digital fortune—can be compromised through channels far removed from the physical device designed to protect it.

The events raise profound questions about the future of self-custody in an increasingly interconnected digital ecosystem, where the security of hardware wallets may ultimately depend on the integrity of marketing databases, software companions, and third-party vendors operating thousands of miles from the secure enclaves where private keys reside.

The D’CENT Investigation: When Software Companion Becomes Security Liability

The D’CENT situation represents perhaps the most direct challenge yet to the assumption that hardware wallet users are immune to remote compromise. Beginning September 16, the company received a trickle of reports that quickly became a flood—users discovering unauthorized transfers from wallets they believed were secured by the company’s biometric hardware devices.

What emerged from the initial investigation paints a complex picture of how security boundaries blur in practice. The affected users, D’CENT revealed, were primarily operating through the company’s App Wallet—a software solution that stores keys directly on mobile devices. More troubling, the company’s preliminary criteria point to wallets where recovery phrases had been entered into the App Wallet environment, combined with transaction-signing activity on versions predating the 8.1.0 release from November 5, 2025.

The potential exposure spans an alarming range of cryptocurrencies, including Bitcoin, Ethereum, XRP Ledger, Tron, and various EVM-compatible networks. But perhaps most concerning is the crossover risk for hardware wallet users who, seeking convenience, may have imported their device-generated recovery phrases into the software application.

D’CENT has been characteristically careful in its public statements, emphasizing that simply connecting a hardware device to the app does not transfer the recovery phrase to the phone. The vulnerability emerges through manual import—the deliberate act of entering those precious words into software for whatever reason—convenience, backup, or migration to a new device.

The company’s response has been methodical: advising potentially affected users to update the application before signing any further transactions, create entirely new wallets with fresh recovery phrases, and migrate assets away from any wallet that might have been exposed. Simultaneously, D’CENT has engaged with exchanges, law enforcement agencies, and blockchain forensic teams in an attempt to trace and potentially freeze stolen assets before they can be laundered through the increasingly sophisticated cryptocurrency money-laundering ecosystem.

Security experts note that this incident highlights a fundamental tension in hardware wallet design. The devices themselves remain cryptographically sound—no one has found a way to extract keys directly from the secure element chips. But the ecosystem surrounding them, including the software applications designed to make them user-friendly, creates attack surfaces that sophisticated adversaries are increasingly eager to exploit.

Trezor’s Marketing Breach: Customer Data Becomes Attack Infrastructure

If D’CENT’s problems stem from software directly interacting with wallet functionality, Trezor’s latest headache demonstrates that even peripheral systems can become weapons in the hands of determined attackers. The breach, which occurred through third-party marketing provider Brevo, exploited a vulnerability in the vendor’s Security Assertion Markup Language (SAML) single-sign-on implementation—a technical flaw that allowed attackers to reach 138 customer accounts.

What happened next should concern every cryptocurrency holder, regardless of their wallet choice. Attackers exported contact information from 43 compromised accounts and, more troublingly, used six of those accounts to dispatch phishing emails through what appeared to be entirely legitimate infrastructure. The messages passed standard email authentication checks, arriving in victims’ inboxes with the same digital fingerprints as legitimate communications from the hardware wallet manufacturer.

The phishing campaign itself was sophisticated and targeted: recipients were informed of a “critical hardware vulnerability” and directed to download an application that would supposedly patch the issue. In reality, the application was designed to harvest wallet backup phrases—effectively providing attackers with the keys to whatever cryptocurrency holdings the victims controlled. Approximately 2,500 individuals reached the malicious domain before Trezor managed to disable it, though the company has been careful to note that merely clicking the link did not expose funds.

The real danger materialized when users, convinced they were protecting their assets from a legitimate threat, entered their recovery phrases into the malicious application. At that moment, the hardware wallet’s security guarantees became meaningless—the attacker possessed everything needed to reconstruct the wallet on their own devices and drain it at leisure.

The long-term implications of this breach extend far beyond the initial phishing campaign. The export of 347,149 verified email contacts creates a permanent attack surface that malicious actors can exploit for years to come. These are not random email addresses scraped from the internet; they belong to individuals who have demonstrated both cryptocurrency holdings and a willingness to invest in security hardware. For phishing specialists, such a list represents an extraordinarily valuable asset—one that can be resold, shared, or retained for carefully timed future campaigns built around security alerts, software updates, or customer support interactions.

The August Warning: A Pattern of Vendor Vulnerability

Trezor’s latest breach follows uncomfortably on the heels of another security incident that exposed the company’s reliance on external vendors. In August, a shipping-provider incident disclosed customer identity information and order details, including phone numbers and physical addresses. While the company maintained—accurately—that the wallets themselves remained unaffected, the pattern is clear: Trezor’s security posture is only as strong as its most vulnerable vendor.

The August incident, which involved the compromise of customer data held by a third-party logistics provider, revealed something that sophisticated attackers prize nearly as much as private keys themselves: the intersection of digital identity with physical location. Armed with phone numbers, shipping addresses, and confirmation that the individual owns cryptocurrency hardware, attackers possess everything needed for targeted social engineering campaigns that bypass technical security measures entirely.

Security analysts point out that these vendor breaches represent a fundamental shift in how cryptocurrency-related attacks are evolving. Rather than attempting to break the formidable cryptographic protections embedded in hardware wallets—an endeavor that has repeatedly proven futile against well-designed devices—attackers are increasingly focusing on the human and organizational elements surrounding the technology. The recovery phrase remains the holy grail, but the paths to obtaining it now run through marketing databases, shipping manifests, and customer support systems rather than through the silicon itself.

The implications for the broader cryptocurrency ecosystem are profound. Hardware wallet manufacturers have built their reputations on the promise of impenetrable security, marketing their products as digital equivalents of bank vaults. Yet these incidents reveal that the vault, however secure, exists within a larger building with multiple entrances—some of which may be controlled by entirely different organizations with different security priorities.

A Critical Juncture for Self-Custody Security

The cryptocurrency industry stands at a critical juncture as these incidents unfold. The fundamental promise of self-custody—that individuals can maintain complete control over their digital assets without relying on third parties—remains one of the most compelling arguments for cryptocurrency adoption. Hardware wallets have been the cornerstone of this promise, providing a physical barrier between private keys and the internet’s endless array of threats.

Yet the D’CENT and Trezor incidents reveal that self-custody is not an absolute state but a spectrum of security decisions. Every interaction between a hardware wallet and the broader ecosystem—software updates, companion applications, marketing communications, even the shipping process that delivers the device—introduces potential vulnerabilities. The recovery phrase, designed as a backup mechanism, has become the primary target for attackers precisely because it represents a single point of failure that bypasses all other security measures.

For users, these incidents underscore the critical importance of understanding exactly where their recovery phrases reside. A phrase generated on a hardware device but entered into a software application, written into a cloud document, photographed for safekeeping, or shared during a support interaction has effectively left the secure environment that made it valuable in the first place. The discipline of keeping recovery phrases completely offline and never entering them into any digital system remains the single most important practice for maintaining the security promises of hardware wallets.

The incidents also raise uncomfortable questions about the concentration of risk in the cryptocurrency ecosystem. When millions of users across the globe rely on a handful of hardware wallet manufacturers, a vulnerability in any part of those companies’ operational infrastructure—not just their cryptographic implementations—becomes a systemic risk to the entire industry. The response of exchanges, law enforcement agencies, and blockchain forensic teams to the D’CENT and Trezor incidents will set important precedents for how the industry handles such events in the future.

The Road Ahead: Security as Ecosystem, Not Device

As both companies work to contain the damage and understand the full scope of these incidents, the broader cryptocurrency community must confront an uncomfortable truth: hardware wallet security is no longer just about the device itself. The marketing departments that maintain customer databases, the software engineers who build companion applications, the vendors who handle shipping and email communications—all have become integral components of the security infrastructure that protects digital assets.

Trezor’s response—suspending its Brevo account and conducting a comprehensive review of vendor relationships—acknowledges this new reality. Brevo’s technical response, closing the SAML SSO route and deploying a permanent authentication fix, addresses the immediate vulnerability but cannot undo the damage already done through the exposure of customer contact information.

D’CENT’s ongoing investigation, with its focus on tracing stolen assets through exchanges and law enforcement channels, highlights another emerging challenge: the difficulty of recovering funds once they have been moved from compromised wallets. The cryptocurrency ecosystem’s pseudonymous nature, combined with the speed at which assets can be transferred across borders, makes remediation a complex and often unsuccessful endeavor.

For the industry as a whole, these incidents should serve as a catalyst for fundamental changes in how hardware wallet security is conceptualized and marketed. The competitive advantage of the future will belong to companies that can demonstrate not just the cryptographic strength of their devices but the security of their entire operational ecosystem—from the manufacturing floor to the marketing department, from the shipping warehouse to the software update server.

The promise of self-custody remains as compelling as ever, but its fulfillment requires a more holistic understanding of security than the industry has traditionally offered. The hardware wallet may be the castle, but the kingdom includes the surrounding territory—and the kingdom, these incidents make clear, is only as secure as its most vulnerable province.

As the investigation continues and the cryptocurrency community processes the implications of these events, one thing becomes increasingly certain: the future of hardware wallet security will be determined not in the silicon of secure enclaves but in the software, systems, and relationships that surround them. The attackers have adapted, and now the defenders must follow.