Nearly 14,000 Trezor customers have had personal information exposed after an unauthorized party breached systems belonging to ShipMonk, a third-party shipping and fulfillment provider used by the hardware wallet manufacturer. The compromised information includes names, email addresses, phone numbers and, for nearly 12,000 customers, shipping addresses, creating serious phishing and potentially physical-security risks for cryptocurrency holders.
Trezor stressed that its own internal systems were not compromised and its hardware wallets remain secure. There is no indication that private keys, recovery seed phrases, wallet balances or cryptocurrency were exposed through the breach. The incident instead demonstrates another growing security problem for crypto users — personal information held by third-party companies can become dangerous when attackers know those customers are likely to own digital assets.
11,742 Customers Had Shipping Addresses Exposed
ShipMonk notified Trezor on Monday that an unauthorized party had gained access to systems containing customer order information.
Trezor subsequently determined that 11,742 customers had the following information exposed:
- Names
- Email addresses
- Phone numbers
- Shipping addresses
Another 1,947 customers had their names, cities and email addresses compromised. Combined, the incident affected roughly 13,700 people.
Affected customers are located across the United States, United Kingdom, Sweden, Colombia, Brazil, Italy and Portugal.
Trezor Wallets and Internal Systems Were Not Hacked
One of the most important distinctions is that this was not a breach of Trezor’s hardware wallets or internal systems.
The attack occurred at ShipMonk and involved customer order information stored by the shipping provider.
Trezor says its hardware wallets remain secure. The reported breach therefore does not mean attackers can access customers’ Bitcoin or other cryptocurrency simply because their personal information was exposed.
However, possession of that personal data gives criminals information they can potentially use to target specific Trezor customers.
Trezor Says This Is a First for the Company
The incident is particularly significant because Trezor was founded in 2013 and helped pioneer the cryptocurrency hardware wallet industry.
According to the company, this represents the first breach in its history that has exposed customer phone numbers and shipping addresses.
That doesn’t mean Trezor’s wallet technology itself failed. Instead, it illustrates how a company’s security can extend far beyond the hardware and software it directly controls.
Manufacturers still depend on logistics companies, payment processors, e-commerce platforms and other outside businesses that may possess sensitive customer information.
Phishing Attacks Could Be the Immediate Threat
The most immediate concern is targeted phishing.
Attackers now potentially possess enough information to create convincing messages impersonating Trezor, cryptocurrency exchanges, banks or other financial companies.
Instead of sending a generic crypto scam, criminals could potentially contact a victim using their real name, email address, telephone number and physical address.
That makes fraudulent communications considerably more convincing.
An attacker could falsely claim that a customer’s Trezor has been compromised and instruct them to enter their recovery phrase into a fake website or provide it to a supposed support representative.
Trezor will never need a user’s recovery seed to resolve an account or security issue.
Home Addresses Create a More Serious Security Problem
The exposure of physical addresses makes this incident considerably more concerning than a conventional email leak.
Hardware wallet customers are particularly sensitive targets because purchasing a Trezor can indicate that an individual owns cryptocurrency and takes self-custody seriously.
That doesn’t reveal how much cryptocurrency someone owns, but criminals may interpret the information as evidence that the person controls digital assets.
The Block noted that crypto-related criminals have increasingly used leaked personal information to identify victims for home invasions, kidnappings and physical attacks intended to force people to surrender cryptocurrency.
According to Chainalysis data cited in the report, more than $30 million had already been stolen through violent crypto-related attacks during the first half of 2026, putting the year on pace to exceed the approximately $58 million stolen through such attacks during all of 2025.
Ledger Customers Have Faced Similar Data Leaks
Trezor isn’t the first major hardware wallet manufacturer to encounter this problem.
Earlier this year, Ledger customers were notified about another third-party breach involving e-commerce provider Global-e, which exposed customer names and contact information.
An even larger Ledger incident occurred in 2020, when attackers obtained information belonging to more than 270,000 customers.
That data eventually appeared on a hacking forum and included names, email addresses, telephone numbers and, for some customers, physical addresses.
The consequences didn’t disappear when the initial news cycle ended. According to The Block, some Ledger customers continue receiving scam phone calls and physical letters six years later from criminals attempting to obtain recovery phrases and other sensitive information.
That history suggests Trezor customers affected by the ShipMonk breach may need to remain cautious for much longer than the immediate aftermath.
What Affected Trezor Customers Should Watch For
Customers notified that their information was included in the breach should be particularly skeptical of unexpected communications claiming to come from Trezor.
The most important rule is simple — never provide your recovery seed phrase to anyone.
A legitimate Trezor representative does not need the recovery phrase to provide customer support. Customers should also avoid clicking unexpected links sent through emails or text messages claiming that their wallets need to be “verified,” “secured,” “upgraded,” or “recovered.”
Because physical addresses were exposed, affected users should also consider the information a personal-security issue rather than merely a cybersecurity issue.
What This Means for Crypto
The Trezor incident highlights a security problem that self-custody alone cannot solve.
A hardware wallet can successfully keep private keys offline while a completely unrelated company still exposes information capable of identifying who owns that hardware wallet and where they live.
That’s particularly dangerous in crypto because blockchain transactions are irreversible and individuals holding assets in self-custody can become direct targets. Unlike money held inside a traditional bank, there may be no institution capable of freezing a transaction or reversing a transfer after someone is physically coerced into sending cryptocurrency.
The incident also exposes a weakness in the broader crypto industry’s reliance on third-party infrastructure. Trezor itself wasn’t breached. ShipMonk was. Yet Trezor customers now carry the consequences.
For hardware wallet manufacturers, protecting private keys may therefore no longer be enough. Companies may increasingly need to consider data minimization, shorter retention periods, anonymized fulfillment systems and how much customer information third-party logistics providers actually need to retain.
The crypto industry has spent years teaching users that the recovery phrase is the most sensitive information associated with a hardware wallet. Incidents like this demonstrate that another piece of information deserves considerably more attention — the connection between a person’s real identity, their home address and the fact that they own a hardware wallet.
