The biggest vulnerability in your Bitcoin wallet might be the shipping label

Hardware wallets might be able to protect your keys, but the paperwork from buying them could expose your identity.

To buy a hardware wallet, you give a company your name and address so it can send you a device designed to put you in control of your money. Once you've unpacked the box and set it up, there is little reason to think about the order again.

However, somewhere in the delivery business a record of that purchase may survive for years.

In a Sept. 4 update to its shipping-provider breach disclosure, Trezor said approximately 67,000 additional US customers were affected, including orders from 2019 to 2021. It said ShipMonk, the shipping company tasked with delivering the devices, gave it written assurances that it deleted the records. The company now lists 80,689 affected customers overall.

Trezor says its systems and devices were unaffected and that the contents of parcels weren't exposed. The leaked information included only contact and delivery details, so no funds were stolen or misappropriated.

And while the financial damage so far is zero, those contact details create a bigger problem for the customer that has outlasted the purchase and could continue well into the future.