The interesting term here is the qualification step, and Rapid7's account of Operation ASTERIX prices it for us: before anyone could be steered toward a counterfeit app, the attackers had to query exchange APIs and filter for accounts likely to hold balances worth the trouble [4]. That is inference with a wide error band, because an exchange balance tells you someone trades, not that they hold their own keys. A fulfilment record is the opposite kind of evidence, a payment-verified statement that a named and contactable person bought a device whose only job is holding keys away from an exchange, and 11,742 of the 13,689 people in the ShipMonk file had precisely that exposed, names and contact details in full [1][2], which is 85.8 per cent of the list [12]. The remaining 1,947 got off with less [13].
Now price it from the other side of the table. A recovery seed is twelve or twenty-four words, and whoever reads it owns the wallet outright [8], so a crew working this list needs one person in 13,689 to type or recite theirs to clear a hit rate of 0.0073 per cent [14]. There is no defensive comfort available at that denominator. The AI part of the story, the cloned Trezor environment that harvested seeds into a Telegram channel [5], is a manufacturing improvement in the lure; the breach is an improvement in the aim, and aim was the scarcer input.
What Trezor can actually do about it is the part worth watching, because the answer is nothing structural. Its head of security, Jan Komarek, names phishing and AI-assisted social engineering as the top threats to crypto users [10] and his remedy is a habit, never type a seed into anything online [9], plus a standing negative promise that the company will never call and ask for one [7]. The hardware was not touched in any of this [3]. So the engineering budget that makes the device trustworthy buys nothing against a customer table sitting in a third party's system, and the security lead's public voice is now spent on user conduct rather than on the product he controls. That is the allocation cost, and it does not appear on anyone's income statement.
This is probably wrong in the direction of over-crediting the file, and the counter-thesis deserves saying in the same breath: a buyer list is not a balance list. The source describes names and contact details, not addresses on chain or holdings [2], and some fraction of those 13,689 bought gifts, resold, or never funded anything, so conversion could sit near zero. The likelier place this lands is the voice channel, where a caller who can recite your order details walks you through a fake security procedure and asks you to read the words aloud [6], because credibility is the input phishing has always been short of. Komarek's warnings arrive into a market where phishing against crypto users has been climbing steadily through 2025 and 2026 across multiple firms' tracking [11], meaning the capacity to work a list like this already exists.
The falsification is clean enough. If reported losses over the next year show no concentration among ShipMonk-exposed customers, or if API-side filtering stays cheaper per victim than working a stale 13,689-name file, then the manifest was a nuisance rather than an input, and self-custody's threat model survives having its customer list published.
