TL, DR: If you buy a hardware wallet, make sure to never disclose your real name or real address as a best practice. BitcoinVN Shop is an authorized supplier of Passport Prime hardware wallets by Foundation Devices in Vietnam and offers privacy-preserving purchase options
Breach at Foundation Devices – customer data exposed, no evidence of compromised hardware
In October 2026, Foundation, the maker of Passport hardware wallets, disclosed a customer-data incident accompanied by phishing emails designed to trick recipients into revealing their recovery phrases.
The company reported no evidence that Passport devices or their private keys had been compromised. The incident nevertheless highlights a broader concern for anyone practising self-custody: the records linking your identity to a hardware wallet purchase can create risks that the device itself cannot address.
Hardware wallets protect keys – customer databases become target lists
Recently, there has been an alarming uptick in targeted breaches of client databases held by hardware wallet manufacturers and their reseller partners.
The incentive is straightforward: selling stolen customer records as ready-made target lists on darknet markets can be extremely lucrative and the buyers of these lists are only willing to pay this good money for these target lists because they expect a strong positive ROI. The persistent demand for these client databases by criminal organizations shows that from the buyers’ perspective, these target lists continue to offer strongly positive expected value.
While hardware wallets remain one of the best ways for ordinary cryptocurrency users to protect their funds against common cyber threats, having their name and home address linked to the purchase of such devices does turn them into prime targets for criminal organisations.
In the “best case”, you become a recurring target for social-engineering attacks.
An email quoting your name, the device you purchased and your delivery address can make a fraudulent recall or urgent “security update” appear convincing. Those details create a sense of familiarity, encouraging the recipient to trust the sender and follow their instructions. In Foundation’s case, the phishing campaign sought to persuade users to reveal their recovery phrases – giving attackers a route to their funds without having to compromise the hardware itself.
In the worst-case scenario, you live in a country where the authorities lack the capacity or willingness to combat violent crime effectively. The alarming rise in violent attacks on cryptocurrency users in parts of Western Europe illustrates how serious this threat can become. For someone facing a credible threat after their details have been leaked, relocating for safety may become necessary – even to the point of leaving their home country.
A customer record identifying someone as a hardware wallet buyer does not reveal how much cryptocurrency they hold, but it does mark them as a prospective target – someone criminals suspect has “money behind the door”. Exposed phone numbers and home addresses can facilitate further scams, harassment or attempts at extortion, including serious physical threats.
You suspect your name was leaked in a crypto-related database breach?
Being mentally prepared is often more than half the battle. Attackers exploit human psychology through fear, urgency and a false sense of familiarity. Do not give them the advantage of surprise.
If your personal information was leaked, expect targeted approaches using details you would assume only a legitimate insider could know. That is precisely what criminals buy these databases for: to make their approach convincing.
If someone contacts you claiming your wallet is compromised or needs an urgent “security update”, remember these three rules:
- Never hand over your recovery words. Do not read them over the phone, send a photograph or enter them into a website. Legitimate support does not need them.
- No downloads or remote access for unsolicited “support”. Do not install software or give someone access to your computer because a caller or email tells you to. Obtain updates through the manufacturer’s verified channels.
- Do not move funds to a “safe wallet” supplied by someone else. Never use recovery words provided by a caller or email. Anyone who supplied those words can access that wallet.
Buying a hardware wallet? Avoid handing over your personal data
The moment you buy a hardware wallet and provide your real name, home address and other sensitive information, you should work on the assumption that those details will eventually reach people looking to target you.
The vendor may be honest and acting in good faith. But even hardware wallet manufacturers – companies whose business is security – have repeatedly suffered severe customer-data breaches. Good intentions do not prevent a database from being compromised.
You may get lucky: your particular vendor or customer record might never be affected. Your security should not depend on that luck.
The first line of defence is to avoid being identified as a target in the first place. Having your name and home address on a list of hardware wallet buyers gives criminals a reason to suspect there is something worth stealing behind your door.
Ideally, buy the wallet in person, pay cash and choose a seller that does not require your personal details. This can keep your identity out of customer and delivery databases while avoiding a bank or card payment record linking you to the purchase.
Depending on where you live, alternatives may include collection points, P.O. boxes or a separate delivery address. These can keep your home address off the parcel, although the collection or forwarding provider may still require identifying information.
The supply chain also matters. Each additional intermediary introduces another opportunity for a device to be intercepted or tampered with. Some specialist resellers offer private collection and understand the privacy concerns of cryptocurrency users better than general electronics retailers. They nevertheless remain attractive targets themselves.
Choose the seller as carefully as the device. The CryptoBilis incident demonstrates that even an authorised reseller can become part of a compromised supply chain when targeted by criminal organisations. If you choose a reseller, look for an identifiable executive team with a long-standing, clean track record and operational due diligence you can trust. None of this guarantees protection against tampering in the upstream supply chain, but it helps you avoid sketchy operators who can significantly increase your risk of receiving tampered devices.
Buying a hardware wallet privately in Vietnam via BitcoinVN Shop
At BitcoinVN Shop, you can purchase your hardware wallet in person at our Saigon headquarters or through our showroom partner ₿itCoffee in Da Nang, without registering on our website or providing a home delivery address. We source devices directly from manufacturers, keeping the supply chain as short as possible, and inspect incoming shipments before sale.
Our leadership and senior team include German and Swedish professionals with extensive relevant industry experience. Their combined backgrounds span more than a decade of hands-on experience securing digital assets through BitcoinVN Exchange, alongside work at leading global electronics manufacturers with government- and military-level supply chain security requirements.
Before collecting a wallet, please contact our support team to confirm that your preferred device and the relevant team members are available, and arrange your pickup slot.
The BitcoinVN Shop team also regularly attends in-person events in and around Saigon, where collection can be arranged. Watch for corresponding announcements on BV Insights.
If you want help choosing a device, planning your backups or reviewing your wider self-custody setup, you can arrange a separate session with BitcoinVN Consulting. Our team draws on more than a decade of practical experience to help you understand your options and the trade-offs involved.
