Trezor data breach affects 13,689 customers: names, phone numbers and home addresses were compromise

Trezor confirms data breach: Order information of thousands of hardware wallet buyers was leaked

On August 13, 2026, Trezor confirmed that a data breach occurred at one of its logistics suppliers, resulting in the exposure of personal order details of thousands of hardware wallet buyers. The user's private key was not affected and the device itself was not compromised, but the leaked data set may be the most dangerous category in the cryptocurrency world: a verified list of hardware wallet owners that includes the recipient address.

Trezor attacked: What happened in the ShipMonk data breach?

On Monday, August 10, 2026, logistics partner ShipMonk notified Trezor that an unauthorized actor had accessed the system containing customer order data. Trezor publicly disclosed the incident three days later, on August 13.

ShipMonk is Trezor's logistics fulfillment partner, storing Trezor products and delivering packages to customers in the U.S., UK and multiple other markets. To deliver packages, ShipMonk holds the recipient's name, delivery address, telephone number, email address and order number. This is the data set leaked this time.

The specific data released by Trezor are as follows:

11,742 customer information was completely leaked: name, email, telephone number and shipping address
1,947 customer information was partially leaked: name, city and email
Total number of customers affected: 13,689

The investigation is still ongoing. Trezor said ShipMonk had ensured the security of affected systems and strengthened security measures after the incident.

Which customers were affected by a Trezor customer data breach?

The leak is limited to new customers who placed orders between May 10 and August 8, 2026, and involves seven countries: the United States, the United Kingdom, Sweden, Colombia, Brazil, Italy and Portugal.

Older order data has been deleted. Trezor enforces a 90-day data retention policy and contractually requires its logistics partners to delete or anonymize order data within 90 days of delivery. It was this policy that limited the scope of the leak to approximately 13,700 people, rather than all buyers in the company's history.

There is a simple way to determine whether you are affected. Trezor has sent an email directly to each affected customer via help@trezor.io If this email is not in your inbox, you are not on the list for this leak. Considering what may happen next, it's worth noting: the scammer will definitely pass off this notification email.

Was Trezor itself hacked? Is the device still safe?

No, the device is safe. This is a supply chain and supplier leak, not a wallet security breach. Trezor's own systems were not compromised. Private keys, wallet backups, mnemonics or firmware were not involved, and the incident itself would not pose a financial risk. The hardware accomplished its mission. The weak link lies in the commercial layer around the product, not the product itself.

This distinction is important at a technical level, but it provides limited comfort in practice. The attacker now has infrastructure-level targeting data: a verified list of cryptocurrency holders, matched to their real home addresses and phone numbers. E-mail leaks are just trouble, but names, together with home address and phone numbers, can accurately identify a specific individual at a specific address, and this person is most likely to hold cryptocurrency.

Trezor also confirmed that this was the first time since the company was founded in 2013 that a customer's telephone number and shipping address had been leaked. Previously, in January 2024, an incident at a third-party support portal leaked the contact details of nearly 66,000 users, but did not involve physical addresses.

Why is this data breach more dangerous than a typical password breach?

Because the cryptocurrency industry already has a response plan for such incidents, and this plan has been in operation since 2020. When approximately 272,000 Ledger customer records (including names, addresses and phone numbers) were released after the company's e-commerce breach in 2020, the consequences never really ended. Victims reported that they had suffered a series of phishing emails and text messages, and even received counterfeit hardware wallets sent to their homes in 2021, physical letters with malicious QR codes, and fraudulent phone calls claiming to know them. Some even received extortion demands with threats of violence.

Personal safety risks are no longer theoretical. CertiK verified 52 physical attacks on cryptocurrency holders around the world in the first half of 2026, up from 39 in the same period last year, and burglary has replaced kidnapping as the most common method. Chainalysis data shows that more than $30 million was stolen through violent attacks during the same period, which is expected to exceed the total amount of approximately $58 million for the whole of 2025. Suppliers have repeatedly proven to be the weakest link in the chain. Ledger's payment processor Global-e leaked customer order data in January 2026. Within days, attackers used the leaked order details to send phishing emails announcing a false merger between Ledger and Trezor. One troubling detail about ShipMonk is that the vendor holds SOC2 Type II certification, an audited security standard, but was still hacked.

What should Trezor customers do now?

Trezor's recommendations are brief, and industry records show they are effective:

Never enter your wallet backup or mnemonic words on any website. No legitimate company (including Trezor) will ask you to provide this information. Consider a sense of urgency as a red flag. Any message that calls for immediate action or requests personal information should be considered malicious until proven harmless. Cross-verification is conducted through official channels, including official blogs and verified social media accounts. Enter the URL manually instead of clicking on the link. Be wary of contacts from all channels, not just emails. Fake phone calls, text messages, physical letters, and impersonation of a bank, exchange or Trezor itself can all occur. If your complete address is compromised, please consider your personal safety. Publicly discussing one's positions, especially when linked to one's true identity, brings substantial risks.

Any user who wishes to check status or raise concerns can contact Trezor Support directly through the official website.

What are Trezor's anonymous delivery options?

Trezor said it is accelerating the launch of anonymous shipping options, which aim to cut the link between hardware wallet purchases and real identities. Under the planned system, orders will use: a dedicated checkout process, a nickname or tag ID instead of the real name, self-service package locker pickup, unbranded packaging with a universal sender label (carriers only accept email or text message pickup PIN code), and automatic deletion of delivery identifiers after delivery. Trezor plans to launch the feature in the European Union in September 2026 and in the United States by the end of 2026, and describes it as the highest priority project.

During this period, the company recommends placing orders using email addresses unrelated to real identities, paying with cryptocurrency or one-time virtual cards instead of credit cards, and using a post office box where feasible.