Hardware wallet maker Trezor says personal data belonging to nearly 14,000 customers was exposed after a breach at ShipMonk, the third-party shipping provider that handles order fulfillment for the firm.
ShipMonk alerted Trezor on Monday that an unauthorized party had accessed systems holding customer order data. Trezor disclosed the incident in an announcement on August 13. Roughly 13,689 customers across seven countries were affected: the U.S., UK, Sweden, Colombia, Brazil, Italy, and Portugal. All had placed orders between May 10 and August 8, according to Decrypt.
The exposure splits into two tiers. Some 11,742 customers saw full names, email addresses, phone numbers, and shipping addresses leaked. A further 1,947 had names, cities, and email addresses exposed. Trezor credited a 90-day data retention and anonymization policy for limiting the scope. Under that policy, ShipMonk holds only recent order information before anonymizing it.
Trezor stressed that its own internal systems were not compromised. Hardware wallets, private keys, and wallet backups remain unaffected. The breach sits at the shipping layer, not the custody layer.
“This is the first time since Trezor was founded in 2013 that we have experienced a breach that exposed customer phone numbers and shipping addresses,” Trezor said in its announcement, as quoted by The Block.
In a post on X, Trezor told customers: “We have some difficult news to share. Unfortunately, one of our shipping providers has experienced a data breach that exposed sensitive order data.” The firm advised affected users to treat unexpected contact with suspicion and never to enter wallet backups online.
The leak hands attackers something an ordinary retail breach does not. It is a verified list of people who hold crypto, paired with their real-world addresses. Trezor warned that exposed customers face elevated phishing risk, with attackers likely to impersonate Trezor, banks, or crypto exchanges. The concern extends beyond inbox scams. Cointelegraph and Decrypt both flagged the physical-security dimension specific to crypto custody.
The numbers on that front are climbing. Chainalysis reported more than $30 million stolen in violent crypto attacks in the first half of 2026, putting the year on pace to surpass 2025’s full-year total of $58 million. CertiK counted 52 verified physical attacks on crypto holders worldwide in the same period. That is up from 39 a year earlier. Home invasions have overtaken kidnapping as the most common method, according to Decrypt.
The precedent is uncomfortably close. Ledger’s 2020 breach exposed names, addresses, and phone numbers belonging to more than 270,000 customers after attackers accessed marketing and e-commerce data. Six years later, Ledger customers still report phone calls and physical letters from fraudsters impersonating the firm. In January 2026, Ledger disclosed a separate breach at e-commerce partner Global-e that exposed names and contact information.
Trezor said it is accelerating an “Anonymous Delivery” option. The feature includes locker pickup, neutral packaging, generic sender details, and automatic deletion of shipping identifiers. It is targeted for the EU by September and the U.S. by year-end, Decrypt reported.
What remains unknown: the exact date ShipMonk’s systems were first accessed, the identity of the unauthorized party, and whether any of the exposed data has surfaced on dark-web forums. ShipMonk has not issued its own public statement on the incident. Trezor has not said whether law enforcement is involved.
The breach does not touch keys or devices. It touches the people who hold them.
