Two security stories dominated the past 36 hours, and together they paint a clear picture: custody risks in Bitcoin are real, varied, and worth taking seriously — whether you hold coins on a hardware wallet or on a sidechain.
Trezor's Marketing Platform Compromised
Trezor disclosed a data breach after attackers gained access to a third-party marketing platform the company uses, according to Bitcoin Magazine. Scammers used that access to send phishing messages to Trezor customers — emails or texts designed to trick people into handing over seed phrases or login credentials. Trezor has not yet confirmed exactly how many users were affected.
This is not Trezor's first such incident. The hardware wallet maker suffered a similar third-party breach in 2022, when contact data for roughly 106,000 customers was exposed. The pattern matters: even a device that keeps your private keys offline can't protect you if an attacker convinces you to type your seed phrase into a fake website. The hardware is only as safe as the human using it.
What should you do? Don't click links in unexpected emails claiming to be from Trezor. Go directly to trezor.io in your browser. Trezor will never ask for your seed phrase — not by email, not by phone, not ever.
Blockstream Refuses to Pay Ransom After Liquid Exploit
Separately, The Block and Cointelegraph both reported that Blockstream has publicly refused a ransom demand from hackers who exploited the Liquid Network and are currently holding close to 600 BTC — worth roughly $46.6 million at today's price of $77,617.
Liquid is a Bitcoin sidechain built for faster, more confidential transactions, used mainly by exchanges and traders. Following the exploit, Liquid briefly suspended all transactions. As of Thursday, the network had resumed processing transactions, but peg-outs — the mechanism that lets users withdraw funds back to the main Bitcoin blockchain — remain disabled while recovery work continues.
Blockstream said it is working with law enforcement, cryptocurrency exchanges, and blockchain forensics specialists to trace and recover the funds. The company's public refusal to pay is notable. It signals a belief that chain analysis and exchange cooperation can make it difficult for thieves to move or cash out stolen Bitcoin — a posture that has worked in some high-profile cases before, though not always.
What These Two Stories Share
On the surface, a phishing campaign against hardware wallet users and a sidechain exploit look like very different problems. But both reveal the same underlying reality: the attack surface in Bitcoin is almost never the protocol itself. It's the software around it, the platforms connected to it, and the people using it.
- Trezor's breach came through a marketing tool, not the wallet firmware.
- Liquid's exploit targeted the sidechain's own mechanics, not Bitcoin's base layer.
- In the $245 million crypto theft case also reported this week by Bitcoin Magazine, a 22-year-old ringleader pleaded guilty — another reminder that social engineering and coordinated fraud remain the biggest threats most people face.
None of this means Bitcoin itself is broken. It does mean that how you store, access, and interact with Bitcoin matters enormously. Cold storage on a hardware wallet is still among the safest options available — but only if you verify communications through official channels and never share your seed phrase.
For donors giving Bitcoin to charity, using a reputable, well-audited platform to send funds directly — rather than holding large balances on exchange accounts or connected wallets — reduces exposure to exactly the kinds of risks these stories highlight.