Trezor Shipping Partner Breach Exposes Data of Nearly 14,000 Customers

Fulfillment provider ShipMonk suffered a breach that exposed personal data tied to roughly 14,000 Trezor hardware wallet customers. Trezor disclosed the incident late Wednesday. Affected orders spanned seven countries and three months of shipments.

ShipMonk alerted Trezor on Monday that an unauthorized party had accessed systems holding customer order information, Trezor said in an announcement. Trezor went public two days later, on Aug. 13.

Two tiers of exposure emerged. Full names, shipping addresses, phone numbers, and email addresses were compromised for some 11,742 customers, according to Cointelegraph. Another 1,947 customers saw their names, cities, and email addresses leaked. Those orders were placed between May 10 and Aug. 8 and shipped to the U.S., the U.K., Sweden, Colombia, Brazil, Italy, and Portugal.

Trezor was emphatic that its own infrastructure was not involved. “To be clear, our systems were not compromised, and your Trezor device is secure,” the company wrote. Hardware devices, private keys, and backups all remained untouched.

The danger is social, not cryptographic. Attackers could use the leaked contact details to run targeted phishing operations, Trezor warned. “Scammers can use the leaked information to send fake emails, make fake phone calls, send fraudulent letters, or potentially impersonate banks, crypto exchanges, or even Trezor,” the company said.

“This is the first time since Trezor was founded in 2013 that we have experienced a breach that exposed customer phone numbers and shipping addresses,” Trezor added, as reported by The Block.

That framing warrants scrutiny. Roughly 66,000 Trezor users were flagged as at risk of phishing in January 2024 after contacting support since December 2021, Cointelegraph noted. That earlier incident, though, did not expose phone numbers or physical addresses. This week’s disclosure is the first of its kind for the firm.

ShipMonk is a familiar story in hardware wallet security. Ledger disclosed in January 2026 that names and contact information for customers had been exposed through third-party e-commerce provider Global-e. A larger Ledger breach in 2020 compromised data on more than 270,000 customers. That data later surfaced on a hacking forum and fueled phishing campaigns and physical harassment. Six years on, Ledger customers still report phone calls and physical letters from fraudsters impersonating the company to extract seed phrases.

The physical risks are not hypothetical. Criminals increasingly use leaked personal information to target cryptocurrency holders for kidnappings, home invasions, and extortion, The Block reported. A French couple was targeted in three home invasions in under a month during the summer of 2026 after moving into a house formerly owned by crypto millionaires whose tax information and address had appeared on the dark web. Chainalysis data cited in the report put violent crypto-related theft at more than $30 million in the first half of 2026, on pace to surpass the $58 million full-year total for 2025.

Remediation details remain thin. Trezor did not say whether it is offering credit monitoring or identity-theft protection to the affected 14,000 customers. ShipMonk had not publicly commented as of the Trezor announcement.

The breach timeline is also unresolved. Trezor said only that ShipMonk informed it on Monday, not when unauthorized access first occurred or how long it persisted before detection.

Whether the stolen data has surfaced on dark-web markets or forums is not yet known. Trezor’s guidance to affected customers centers on vigilance against phishing, not data removal.

Traders, as ever, disagree on whether the incident damages trust in Trezor specifically or in hardware wallet custody more broadly. The devices were never touched. The supply chain around them was.