Trezor Hardware Wallet Customers Targeted in ShipMonk Logistics Data Breach
A data breach at Trezor's third-party logistics provider, ShipMonk, has exposed the personal information of over 13,000 hardware wallet customers, increasing their risk of phishing and social engineering attacks.
Trezor, a prominent maker of cryptocurrency hardware wallets, has disclosed a data breach affecting its customers, stemming not from its own systems but from a third-party logistics provider, ShipMonk. The incident, reported on August 10, 2026, involved unauthorized access to systems holding customer order data, compromising personal details of individuals who received orders between May 10 and August 8, 2026. Trezor emphasized that its own infrastructure, devices, and firmware remain secure and unaffected by the breach.
The breach impacted approximately 13,689 customers across several countries, including the United States, United Kingdom, Sweden, Colombia, Brazil, Italy, and Portugal. Of these, 11,742 customers had their full names, email addresses, phone numbers, and shipping addresses exposed. A smaller group of 1,947 customers experienced partial exposure, limited to their name, city, and email address. ShipMonk, responsible for storing and shipping Trezor products in key markets, required this information to fulfill customer orders.
Crucially, Trezor's strict 90-day data retention policy played a significant role in limiting the scope of the breach. This policy mandates the deletion or anonymization of order-related personal data 90 days after delivery. Consequently, older records were not present in ShipMonk's systems, preventing attackers from accessing them and thus containing the breach to a more recent, defined period.
Trezor has directly notified affected customers via email from [email protected]. Individuals who have not received such a notification are not part of the exposed group. The company has reiterated that the security of its hardware wallets and internal systems was not compromised, aiming to reassure users about the fundamental safety of their crypto assets.
The primary risk arising from this breach is the potential for sophisticated phishing and social engineering attacks. Threat actors can leverage the leaked contact and address information to craft highly convincing fraudulent communications, including emails, spoofed phone calls, or fake letters, impersonating Trezor support, financial institutions, or cryptocurrency exchanges to trick victims into revealing sensitive information or compromising their accounts.
This incident marks the first time since Trezor's inception in 2013 that customer phone numbers and shipping addresses have been exposed. While acknowledging the seriousness of the situation and apologizing to those affected, Trezor urges customers to exercise extreme caution. They advise treating any urgent requests for personal details or wallet recovery information with suspicion and to always verify communications through official Trezor channels.
To mitigate future risks, Trezor is developing an "Anonymous Delivery" option, slated for rollout in the EU by September 2026 and the US by the end of 2026. This feature aims to enhance privacy through dedicated checkout processes, locker pickups, neutral packaging, and generic sender details, with automatic deletion of shipping identifiers post-delivery.
Operationally, Trezor reports no disruption to its product or service offerings. The company is collaborating closely with ShipMonk on the ongoing investigation, and the logistics partner has reportedly secured and enhanced its systems. Trezor continues to monitor the situation and provide support to its customers, directing them to its official support channels for assistance.