Trezor disclosed that its logistics fulfillment partner, ShipMonk, experienced an unauthorized access incident, resulting in the exposure of some customers' names, phone numbers, email addresses, and shipping addresses. The company stated that its own systems were not compromised, and hardware devices, private keys, and wallet backups remain unaffected.
The scope of the leak is concentrated in orders from the past three months.
According to the company’s disclosure, ShipMonk notified Trezor on Monday that an unauthorized party accessed the system storing customer data. The incident affected 13,689 customers in total, with 11,742 individuals having their full personal information compromised, and an additional 1,947 individuals having their name, city, and email address exposed.
Affected users primarily placed orders between May 10 and August 8, with shipments to the United States, the United Kingdom, Sweden, Colombia, Brazil, Italy, and Portugal. Trezor stated that customers who did not receive the notification email are not affected by this incident.
Trezor also stated that the scope of the breach was limited because partners are required to delete or anonymize order data 90 days after delivery, meaning earlier orders were not retained. The company said this is the first time in its 13-year history that customer phone numbers and shipping addresses have been compromised.
The company reminds users to be vigilant against phishing and targeted harassment.
Trezor is currently urging users to be vigilant against phishing attacks, particularly by being cautious of unsolicited calls, text messages, and emails. The company emphasizes that users should never enter their wallet backup information on any website.
The risks of such incidents do not remain confined to the online realm. Previously, after Ledger suffered a large-scale customer data breach in 2020, some users received ransom demands and violent threats, while others reported receiving highly targeted phishing calls.
According to Chain security firm CertiK, 52 confirmed offline attacks against cryptocurrency holders were recorded globally in the first half of 2026, up from 39 during the same period last year. Chainalysis reported that losses from these incidents during the same period exceeded $30 million.
Anonymous delivery will be launched earlier than planned.
Trezor is rolling out an anonymous delivery solution ahead of schedule, including locker pickup, neutral packaging, generic sender information, and automatic deletion of delivery identification details.
As per the company’s plan, this service will launch first in the European Union in September and expand to the United States before the end of this year. In light of recent security incidents in the hardware wallet industry, manufacturers are accelerating adjustments to their delivery and user privacy protection processes.
Additional information: Trezor noted that recent hardware wallet users have also been affected by the Coldcard vulnerability incident, and industry attention to the associated risks between shipping information, identity exposure, and asset security is increasing.