A data breach at one of Trezor's shipping providers has exposed the names, phone numbers, email addresses and home addresses of thousands of the hardware wallet manufacturer's customers, the company disclosed on Thursday.

ShipMonk, which stores and ships Trezor's products, told the company on Monday that an unauthorized party had reached systems holding customer data. Some 11,742 customers had their full details taken and another 1,947 had names, cities and email addresses exposed, a total of 13,689. Those affected placed orders between May 10 and August 8 and had them shipped to the United States, United Kingdom, Sweden, Colombia, Brazil, Italy or Portugal.

Trezor said its own systems were not compromised and that no device, private key or wallet backup was touched. It attributed the limited scope to a policy requiring partners to delete or anonymize order data 90 days after delivery, which meant older orders were no longer held. Customers who did not receive a notification email are not affected, it said. In 13 years, the company added, it has never before had a breach exposing customer phone numbers and shipping addresses.

Phishing and “wrench attacks”

Trezor's warning concerns phishing, and it advises customers to treat unexpected contact with suspicion and never to enter a wallet backup online. The 2020 precedent at rival Ledger suggests the risk runs further than fraudulent email.

After roughly 272,000 Ledger customers had names, addresses and phone numbers published, some began receiving ransom demands threatening violence. One told Decrypt they received multiple emails and texts a day, while others later reported receiving phishing calls from people who spoke as though they knew them.

Those threats now have more company, with CertiK verifying 52 physical attacks on crypto holders worldwide in the first half of 2026, up from 39 a year earlier, and home invasions overtaking kidnapping as the most common method. Chainalysis put the sum stolen at more than $30 million over the same period and said the year was on course to be the worst on record.

This isn't the first such incident to strike at the vendor chain for hardware wallets. Ledger disclosed a breach at its own e-commerce partner, Global-e, in January, and hardware wallet firms warned of a phishing surge this month as losses from the Coldcard exploit approached $130 million.

The news lands as hardware wallet users were rocked by the recent Coldcard exploit. Some of the 233,000 BTC that left long-term holder wallets around the Coldcard breach, worth roughly $15 billion, came from Ledger and Trezor owners rather than Coldcard customers, moving to multi-signature setups after watching the exploit unfold, according to Casa.

Trezor said it is bringing forward an Anonymous Delivery option using locker pickup, neutral packaging, generic sender details and automatic deletion of shipping identifiers, targeting the European Union by September and the United States by the end of the year.

免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到support@aicoin.com，本平台相关工作人员将会进行核查。