Trezor Data Breach Exposes 13,689 Customers via ShipMonk

HypeMeter

High attention and emotional sentiment detected.

According to Trezor, the leak covers names, shipping addresses, phone numbers, and email addresses. Still, no private keys, seed phrases, or device data left the company. So customer funds remain safe, even as personal details spread.

What Happened at ShipMonk

ShipMonk told Trezor about the unauthorized access on Monday, August 10, 2026. The breach itself started earlier, and it began with a third-party tool.

According to Trezor, attackers exploited a flaw in Metabase, an analytics platform ShipMonk uses. Metabase flagged the issue to ShipMonk around August 6, 2026. From there, the intruder reached order records tied to Trezor buyers.

Trezor stressed one point clearly. Its own systems, wallets, and devices stayed untouched. In short, this was a logistics breach, not a wallet hack.

ShipMonk is a large US-based third-party logistics provider. It runs warehouses across the US, Canada, and the EU, and it handles storage and shipping for many consumer brands. Because it holds order numbers and delivery details, its systems became the soft target here.

So far, ShipMonk has not published a public statement. Details of its customer notices appear only through reporting that quotes the emails. As a result, some specifics still depend on secondary coverage.

Who the Trezor Data Breach Affected

The numbers split into two groups. First, 11,742 customers face full exposure, which includes name, email, phone number, and shipping address.

Next, 1,947 customers face partial exposure, limited to name, city, and email. Together, that adds up to about 13,689 people. Also, Trezor notes the partial group may include some older orders, so it is still verifying the timeframe with ShipMonk.

The leak reaches seven countries. Specifically, it touches buyers in the United States, the United Kingdom, Sweden, Colombia, Brazil, Italy, and Portugal.

Because Trezor keeps order data for only 90 days, the window stays narrow. The exposure covers orders from roughly May 10 to August 8, 2026. Meanwhile, that same retention rule applies to its partners, which limited the damage.

Why the Trezor Data Breach Still Matters

Keys stay safe, yet the exposed data still carries weight. Above all, home addresses and phone numbers open the door to targeted attacks.

First, expect sharper phishing. Attackers can now craft convincing emails, calls, and letters that pose as Trezor, a bank, or an exchange. Trezor itself warned that affected customers may face more sophisticated phishing attempts.

Second, physical risk rises. Known crypto holders with public home addresses can become targets for so-called “wrench attacks,” where thieves use coercion in person. So the concern goes beyond the inbox.

Trezor repeated its core safety rule anyway. Never enter your wallet backup on a website, and never share it with anyone. In other words, no leaked address changes how a seed phrase should be handled.

Trezor Pushes Anonymous Delivery

Alongside the disclosure, Trezor announced a fix aimed at the root problem. The company is prioritizing an “Anonymous Delivery” option for future orders.

Under the plan, buyers use a nickname or label ID instead of a full name. Then they collect parcels from automated lockers in unbranded, neutral packaging with a generic sender. Afterward, the system deletes the identifiers automatically.

Trezor is targeting EU availability by September 2026. Meanwhile, US rollout is set for the end of 2026. So the company is trying to strip identity from the shipping chain entirely.

A Familiar Pattern for Hardware Wallets

This is not Trezor’s first brush with a third-party leak. Back in April 2022, a compromise at a newsletter provider exposed names and emails, which fueled phishing.

Then, in January 2024, attackers reached a third-party support portal and exposed roughly 66,000 records. Notably, though, this week’s incident marks the first time Trezor has seen phone numbers and shipping addresses exposed.

Rival Ledger walked a similar road. In 2020, a breach at an e-commerce partner exposed between 270,000 and 292,000 customer records, and years of phishing and physical threats followed. As a result, many in the community now call the shipper the weakest link.

What Comes Next

For now, Trezor says it found no confirmed misuse of the leaked data. The investigation with ShipMonk continues, and the exact timeframe for older orders is still under review.

Regulators could also weigh in, since the leak spans several jurisdictions. Notably, the UK ICO, EU GDPR authorities, and Brazil’s ANPD all oversee data protection for affected buyers. So far, none has announced a formal action.

Affected buyers should watch for email from help@trezor.io, since Trezor used that address to notify everyone directly. Above all, treat any unexpected Trezor message with caution and verify it independently.

The bigger test is whether Anonymous Delivery ships on schedule. If it does, the Trezor data breach could push the whole hardware wallet sector to rethink how it handles customer identity. Until then, vigilance remains the best defense.