ShipMonk Data Breach Exposes Data of 13,689 Trezor Customers

A data breach at ShipMonk, one of the logistics companies that ships hardware wallets for Trezor, has exposed personal information belonging to roughly 13,689 customers. The ShipMonk data breach did not touch Trezor’s own servers or devices, the company says, but it did leak names, email addresses, phone numbers and, for most victims, home shipping addresses collected between May 10 and August 8, 2026.

Key takeaways

• ShipMonk told Trezor on Monday, August 10, 2026, that an unauthorized party had accessed systems holding customer order data.
• About 11,742 customers had their full names, emails, phone numbers and shipping addresses exposed; another 1,947 had only names, cities and emails leaked.
• The breach affects orders placed between May 10 and August 8, 2026, across the US, UK, Sweden, Colombia, Brazil, Italy and Portugal.
• Trezor devices and internal systems were not compromised, and Amazon-fulfilled orders are unaffected.
• Trezor plans to roll out an anonymous delivery option in the EU by September 2026 and in the US by the end of 2026.

ShipMonk Data Breach Exposes Trezor Customer Data

The trouble started when ShipMonk, which stores and ships Trezor orders in the US, UK and several other markets, discovered unauthorized access to its systems and passed the news along to Trezor on August 10, 2026. Trezor called it “difficult news” in a statement posted on X, saying a shipping provider had suffered a breach that exposed sensitive order data. The company has framed this as an incident tied entirely to a third-party vendor rather than a failure of its own infrastructure.

What Information Was Exposed

The data taken includes full names, phone numbers, email addresses and, for most victims, physical shipping addresses. That combination matters because it gives scammers everything needed to craft convincing, personalized phishing attempts — not just a generic email blast, but messages, calls or letters that reference a real order and a real address.

How Many Customers Are Affected

According to Trezor’s own disclosure, 11,742 customers had the full set of data exposed: name, email, phone number and shipping address. A further 1,947 customers experienced a narrower exposure limited to name, city and email, without a shipping address attached. Combined, that puts the total near 13,689 people, a figure both CoinDesk and The Block rounded to roughly 14,000 in their coverage of the incident. Trezor has said it is still verifying whether some of that partial-exposure group includes older orders that fall outside the stated May-to-August window, and it plans to update its findings as ShipMonk’s investigation continues.

Trezor Devices Remain Secure, But Phishing Risk Rises

Trezor’s hardware and internal systems were not touched in this breach, and the company has been direct about that distinction. “Our systems were not compromised, and your Trezor device is secure,” the company said in its notice to customers. That reassurance matters for anyone worried about wallet security specifically, since the leaked data cannot be used to access funds or bypass device-level cryptography.

What it can be used for is social engineering. This kind of Trezor customer data exposure hands scammers real names, phone numbers and addresses that can be woven into believable fake communications.

Why Attackers Could Target Victims Next

Trezor has warned that affected customers may now see more sophisticated phishing attempts by email, phone or postal mail, with scammers potentially impersonating banks, crypto exchanges or Trezor itself. The company’s advice is straightforward: be suspicious of any message urging immediate action, cross-check anything unusual against Trezor’s official blog and social channels, and never type a wallet backup phrase into a website or share it with anyone.

This is why the phishing risk after breach events tends to outlast the initial headlines. According to CoinDesk, people whose data is exposed in breaches like this one remain vulnerable for years afterward, since stolen logistics records get resold and repurposed for new scams long after the original incident fades from view. CoinDesk cited past cases where extortionists used leaked home addresses to demand ransom payments of $700 to $1,000, and even mailed counterfeit hardware devices directly to victims. The outlet also noted that managing the legal, remediation and reputational fallout from a major customer-data leak has been estimated to cost hardware firms upward of $33 million in comparable cases.

Trezor told CoinDesk it has no confirmed cases yet of the exposed data being published, sold or used in an active scam, and it says it isn’t aware of any hack attempt linked to the incident so far. Customers who bought through Amazon are not affected, since those orders run through a separate fulfillment partner.

How Trezor Is Responding

Every customer whose data was exposed has already received a direct email from [email protected] explaining what happened. Trezor has been clear that silence means safety here: if you didn’t get that email, your information wasn’t part of this breach.

Notifications and ShipMonk’s Security Fixes

On its end, ShipMonk says it has locked down the affected systems and strengthened its security following the incident, and it is now working directly with Trezor to pin down exactly what happened and which records were accessed. Trezor’s customer support team remains available for anyone with lingering questions about whether they were affected or what steps to take next.

Data Retention Rules and the Push Toward Anonymous Delivery

One reason the numbers weren’t higher comes down to policy rather than luck. Trezor enforces a strict 90-day data retention and anonymization rule with its fulfillment partners, meaning ShipMonk is contractually required to delete or anonymize order data three months after delivery. That window is designed to cover the realistic lifespan of an order — shipping, returns, refunds — without holding onto customer information indefinitely. Because of that policy, older orders had already been purged from ShipMonk’s systems by the time the breach occurred, which limited the pool of exposed records.

Looking ahead, Trezor is developing a more permanent fix. The company plans to launch anonymous delivery Trezor customers can use to receive hardware wallets without handing over identifying shipping details — relying on a dedicated checkout, locker pickup, neutral packaging and generic sender information, with shipping identifiers automatically deleted after delivery. That option is expected in the EU by September 2026 and in the US by the end of 2026. In the meantime, Trezor is pointing customers toward interim workarounds: using an anonymous email address at checkout, paying with crypto or disposable digital cards instead of a personal credit card, and using a P.O. Box where possible, though it notes USPS will still require identification and will store its own data in that case.

A Pattern Emerging Across Hardware Wallet Makers

Trezor has called this the first breach in its 13-year history to expose customer phone numbers and shipping addresses specifically, though the company has faced data incidents before. According to CoinDesk, a third-party support portal tied to Trezor’s parent company, Satoshi Labs, was breached in January 2024, affecting around 66,000 people, and another incident in April 2022 compromised data belonging to more than 106,000 Trezor customers. In neither case were device firmware or on-device cryptography breached remotely.

Rival hardware wallet maker Ledger has faced similar problems. CoinDesk reported that Ledger suffered a breach in January tied to third-party e-commerce partner Global-e, on top of a much larger 2020 breach that hit nearly 300,000 users and was later followed by a phishing campaign involving fake Ledger devices mailed to victims. The recurring theme across both companies points to a broader vulnerability: even when a wallet maker’s own cryptography stays airtight, the fulfillment and logistics partners handling physical shipping remain a soft target.

That risk is climbing industry-wide. CoinDesk cited cybersecurity firm SentinelOne’s estimate that global data breaches are up 17% compared with 2025, averaging roughly 2,090 attacks worldwide every week, with breach activity rising around 3% month over month since January. Separately, CoinDesk noted that crypto holders face growing physical danger tied to leaked personal data, pointing to Certik figures showing in-person coercion attacks totaled $124 million in the first half of this year alone — though not all of those cases trace back to a specific data breach.

FAQ

What is ShipMonk and how did they obtain my information?

ShipMonk serves as the logistics provider responsible for warehousing and dispatching Trezor shipments. In order to complete parcel delivery, the company requires customer identification, location details, contact number and electronic mail address — these details are retained exclusively for fulfillment purposes.

What specific data was exposed in the breach?

Exposed data includes customers’ full names, phone numbers, email addresses and shipping addresses for the larger group of victims. A smaller group had only their name, city and email address exposed, without a shipping address.

How can I know if I was affected by this breach?

If you received an email from [email protected] about the security incident, your data was part of the exposure. If no such email arrived, Trezor says you were not affected.

What should I do if my data was exposed?

Stay alert for phishing attempts by email, phone or mail, verify any suspicious communication against Trezor’s official channels, and never enter or share a wallet backup phrase with anyone, online or otherwise.

Article produced with the assistance of artificial intelligence and reviewed by the editorial team.