Trezor Data Breach Exposes Details of 11,000 Customers

A breach at logistics partner ShipMonk exposed personal data of 11,742 Trezor customers. Private keys and recovery seeds remain secure.

Trezor’s core infrastructure, private keys, and recovery seed phrases remain unaffected following a security incident at a third-party provider.

Addresses and phone numbers of over 11,000 customers exposed

The incident impacts orders delivered between May 10 and August 8, 2026. Logistics partner ShipMonk notified Trezor of unauthorized access to its systems on August 10.

For 11,742 customers, full names, phone numbers, email addresses, and home shipping addresses were disclosed. For an additional 1,947 individuals, the compromised information was limited to names, cities, and email addresses.

Affected customers are located across the United States, United Kingdom, Sweden, Colombia, Brazil, Italy, and Portugal.

The scale of this leak is significant beyond just the numbers. Combining names, phone numbers, emails, and physical addresses allows attackers to craft far more convincing messages targeting individuals they know have purchased a hardware crypto wallet.

Data deletion policy limited the breach scale

Potential damages were mitigated by Trezor’s strict requirements for how logistics partners handle customer information.

Under these terms, providers must securely delete or obfuscate order data 90 days after delivery. Consequently, older records were no longer present on ShipMonk’s affected systems.

This mechanism highlights the practical value of limited data retention. When a third-party vendor is compromised, attackers only gain access to information currently residing in their systems rather than a complete history of customer orders.

Wallets are secure, but phishing risks increase

Trezor stated that its own servers, networks, and internal infrastructure were not compromised. The incident does not affect the hardware wallets themselves, private keys, or recovery seed phrases.

This distinction is vital. ShipMonk handles the logistics data necessary for device delivery but does not have access to the keys that secure user crypto assets.

However, the breach creates an immediate secondary risk: social engineering.

An attacker could use the leaked data to send personalized emails or SMS messages, posing as Trezor, a courier, or another related service. Knowing the recipient’s name, address, and the fact that they own a hardware wallet makes such scams significantly more persuasive.

Trezor is urging affected users to be extremely cautious regarding messages requesting seed phrases, private keys, or other login credentials. While the leak does not allow for direct asset transfers, it provides the ammunition needed for attempts to trick users into revealing sensitive data themselves.

The incident underscores the risks third-party vendors pose to hardware wallet manufacturers. While private key protection may remain intact, logistics data opens a separate channel for attacks against device owners.