Trezor Customer Data Exposed in Shipping Partner Breach

A data breach at one of Trezor’s shipping providers has exposed the names, phone numbers, email addresses and home addresses of thousands of the hardware wallet manufacturer’s customers, the company disclosed on Thursday.

ShipMonk, which stores and ships Trezor’s products, told the company on Monday that an unauthorized party had reached systems holding customer data. Some 11,742 customers had their full details taken and another 1,947 had names, cities and email addresses exposed, a total of 13,689. Those affected placed orders between May 10 and August 8 and had them shipped to the United States, United Kingdom, Sweden, Colombia, Brazil, Italy or Portugal.

Trezor said its own systems were not compromised and that no device, private key or wallet backup was touched. It attributed the limited scope to a policy requiring partners to delete or anonymize order data 90 days after delivery, which meant older orders were no longer held. Customers who did not receive a notification email are not affected, it said. In 13 years, the company added, it has never before had a breach exposing customer phone numbers and shipping addresses.

Phishing and “wrench attacks”

Trezor’s warning concerns phishing, and it advises customers to treat unexpected contact with suspicion and never to enter a wallet backup online. The 2020 precedent at rival Ledger suggests the risk runs further than fraudulent email.

After roughly 272,000 Ledger customers had names, addresses and phone numbers published, some began receiving ransom demands threatening violence. One told Decrypt they received multiple emails and texts a day, while others later reported receiving phishing calls from people who spoke as though they knew them.

Those threats now have more company, with CertiK verifying 52 physical attacks on crypto holders worldwide in the first half of 2026, up from 39 a year earlier, and home invasions overtaking kidnapping as the most common method. Chainalysis put the sum stolen at more than $30 million over the same period and said the year was on course to be the worst on record.

This isn’t the first such incident to strike at the vendor chain for hardware wallets. Ledger disclosed a breach at its own e-commerce partner, Global-e, in January, and hardware wallet firms warned of a phishing surge this month as losses from the Coldcard exploit approached $130 million.

The news lands as hardware wallet users were rocked by the recent Coldcard exploit. Some of the 233,000 BTC that left long-term holder wallets around the Coldcard breach, worth roughly $15 billion, came from Ledger and Trezor owners rather than Coldcard customers, moving to multi-signature setups after watching the exploit unfold, according to Casa.

Trezor said it is bringing forward an Anonymous Delivery option using locker pickup, neutral packaging, generic sender details and automatic deletion of shipping identifiers, targeting the European Union by September and the United States by the end of the year.