What Information Was Exposed In The Trezor Breach?
Nearly 14,000 Trezor customers had personal information exposed after an unauthorized party accessed order data held by ShipMonk, a third-party shipping provider used by the hardware wallet manufacturer.
ShipMonk informed Trezor on Monday that its systems containing customer order information had been accessed. The breach exposed names, email addresses, phone numbers and shipping addresses belonging to 11,742 customers. Another 1,947 customers had their names, cities and email addresses exposed, bringing the total number affected to roughly 13,700.
The customers are located across the U.S., UK, Sweden, Colombia, Brazil, Italy and Portugal.
Trezor said its own systems were not breached and that its hardware wallets remain secure. The incident therefore does not indicate that attackers gained access to users’ private keys, seed phrases or cryptocurrency directly.
“This is the first time since Trezor was founded in 2013 that we have experienced a breach that exposed customer phone numbers and shipping addresses,” the company said.
The distinction matters because the immediate threat is not a technical compromise of Trezor wallets. Instead, attackers now possess information that can be used to identify and contact people known to have purchased cryptocurrency hardware wallets.
Why Does Leaked Contact Data Create A Crypto Security Risk?
Names, phone numbers and email addresses can make phishing attacks more convincing. Criminals can impersonate Trezor, cryptocurrency exchanges, banks or customer support representatives while using accurate personal information to make messages appear legitimate.
A scammer could claim that a wallet requires an urgent security update, that an account has been compromised or that a customer must verify ownership of a device. The objective would typically be to obtain a seed phrase, private key, password or approval for a fraudulent transaction.
Shipping addresses create a more serious security concern because they can connect cryptocurrency ownership with a physical location. Hardware wallet buyers may hold anything from small balances to substantial digital asset portfolios, but attackers have no reliable way of knowing which customers are wealthy. A leaked address can therefore make any affected buyer a potential target.
Investor Takeaway
The Trezor incident did not compromise the wallets themselves, but leaked addresses and phone numbers can create risks that persist for years. Affected users should treat unexpected messages, calls and physical correspondence involving their crypto holdings as potentially malicious.
Why Are Hardware Wallet Customer Leaks Especially Sensitive?
Previous breaches involving rival hardware wallet manufacturer Ledger show how long stolen customer information can remain useful to criminals.
Ledger customers were warned in January that names and contact details had been exposed after unauthorized access to order information held by third-party e-commerce provider Global-e.
A much larger Ledger incident in 2020 affected more than 270,000 customers after attackers obtained marketing and e-commerce records. Names, email addresses, phone numbers and some home addresses were later published online.
The consequences continued well beyond the original breach. Customers reported phishing attempts, harassment and fraudulent communications, while some continued receiving scam phone calls and physical letters years later from people impersonating Ledger and attempting to obtain seed phrases.
That history shows why deleting compromised data from an affected vendor does not eliminate the risk once attackers have obtained a copy. Customer information can be sold, redistributed and combined with other leaked databases for future targeting.
Could The Breach Increase Physical Threats To Crypto Holders?
The most severe risk arises when leaked home addresses are used to identify cryptocurrency owners for robbery, kidnapping or home invasion.
Physical attacks against crypto holders have become more costly. Chainalysis data showed that more than $30 million was stolen through violent crypto-related attacks during the first half of 2026, putting the year on course to exceed the $58 million recorded during all of 2025.
The threat can extend beyond the original owner of the leaked information. In France, a couple was reportedly targeted in three home invasions in less than a month after moving into a property previously owned by cryptocurrency millionaires whose address and tax information had appeared on the dark web.
For Trezor customers affected by the ShipMonk breach, the practical risk will vary depending on what information was exposed and whether criminals obtain or redistribute the dataset. Those whose home addresses and phone numbers were compromised face a higher level of exposure than customers whose leaked information was limited to names, cities and email addresses.
The incident also shows a weakness that hardware wallet security alone cannot solve. Even when private keys remain offline and the device itself is uncompromised, customer information held by shipping, payment and e-commerce providers can reveal who owns crypto products and where they live.
