A data breach at ShipMonk, Trezor’s shipping partner, has exposed the personal information of 13,689 Trezor customers, the company disclosed on Thursday, August 13, 2026. The incident involved unauthorized access to systems containing customer names, phone numbers, email addresses, and home addresses for some affected individuals.
Trezor’s Core Security Remains Intact
Trezor stated that its own systems were not compromised, and crucially, no Trezor devices, private keys, or wallet backups were accessed. The breach affected customers who placed orders between May 10 and August 8 and had them shipped to the United States, United Kingdom, Sweden, Colombia, Brazil, Italy, or Portugal. Of the total affected, 11,742 customers had their full details exposed, while an additional 1,947 customers had their names, cities, and email addresses compromised.
Trezor attributed the limited scope of the data exposure to its policy requiring partners to delete or anonymize order data 90 days after delivery. In its 13 years of operation, Trezor has not previously experienced a breach that exposed customer phone numbers and shipping addresses. Customers who have not received a notification email from Trezor are reportedly not affected.
Broader Threat Landscape and Industry Precedents
This incident occurs against a backdrop of increasing security threats targeting cryptocurrency holders. Hardware wallet firms have recently warned of a surge in phishing attempts, exacerbated by significant exploits such as the Coldcard breach, which reportedly coincided with losses approaching $130 million. CertiK reported 52 physical attacks on crypto holders globally in the first half of 2026, an increase from 39 in the same period the previous year, with home invasions becoming the most common method.
The precedent set by a similar breach at rival Ledger in January 2020, where data from its e-commerce partner Global-e coincided with widespread phishing and threats against customers, underscores the potential downstream risks associated with third-party vendor data exposures. Some reports suggest that a portion of Bitcoin moved from long-term holder wallets following the Coldcard exploit originated from Ledger and Trezor owners seeking more secure multi-signature setups, according to Casa.
Trezor’s Mitigation Efforts
In response to such risks, Trezor is accelerating the rollout of an Anonymous Delivery option. This service will feature locker pickup, neutral packaging, generic sender details, and automatic deletion of shipping identifiers. The option is slated for implementation in the European Union by September and in the United States by the end of 2026.
Key uncertainties remain regarding the exact timeline of the unauthorized access to ShipMonk’s systems and the potential malicious use of the exposed customer data. Trezor advises customers to remain vigilant against phishing attempts and to never enter their wallet backup information online.
Why This Matters
The breach at Trezor’s shipping provider, ShipMonk, exposed personal data of Trezor customers, highlighting the persistent risks associated with third-party vendor security in the hardware wallet ecosystem. This incident underscores the evolving landscape of physical and digital threats targeting cryptocurrency holders, necessitating vigilance against phishing and physical attacks.
Broader Context
This factual news is placed within the context of increasing physical attacks on crypto holders and previous breaches at rival hardware wallet providers. The incident highlights the critical need for robust third-party vendor security and proactive customer protection measures, as demonstrated by Trezor’s introduction of an Anonymous Delivery option.
