Today’s Field Note

Two physical-risk breaches landed in the same window, and both matter more than any price headline. Trezor’s shipping vendor ShipMonk leaked roughly 14,000 customer records (names, emails, phones, and for many, home shipping addresses), each one tied to a confirmed hardware wallet purchase. Separately, Israel’s largest exchange Bits of Gold was breached, exposing customer ID details and deposit addresses. These are wrench-attack maps, not phishing lists. On the software side, DefiLlama’s founder confirmed a fake DefiLlama app made it onto the Apple App Store and drained a wallet before Apple pulled it, so the “verified store equals safe” assumption is dead again.

Today’s Move

  • If you bought a Trezor via ShipMonk fulfillment, assume your home address is now linked to your holdings. Do not keep meaningful balances at that physical location, and treat any “Trezor support” call or email as hostile.
  • Bits of Gold users: rotate deposit addresses, move funds off the exchange, and lock down anyone who can find you through leaked ID data.
  • Do not install any “DefiLlama” mobile app right now. Use the web interface at the known domain only, and verify no official native app exists before trusting one.
  • Audit any wallet that touched a recently installed mobile “portfolio” or “DeFi” app: revoke approvals via Revoke.cash and move assets to a fresh key if in doubt.
  • For high-value holders, this is the day to normalize a 2-of-3 multisig or threshold setup so a single coerced signature does not empty everything.

Resources

  • https://www.reddit.com/r/CryptoCurrency/comments/1vp71ny/trezor_data_breach_exposes_almost_14000_customers/
  • https://www.reddit.com/r/CryptoCurrency/comments/1vpukch/the_largest_crypto_exchange_in_israel_was_just/
  • https://cointelegraph.com/news/defillama-delayed-app-launch-fake-phishing-apps-apple?utm_source=rss_feed&utm_medium=rss_tag_hacks&utm_campaign=rss_partner_inbound
  • Incident trackers (reference standard): Rekt leaderboard · SlowMist Hacked

More: Issues · Field Notes · RTFM

Daily field notes, weekly Issues. Follow @ItsAlreadyPrice or subscribe via RSS.