Summary
- Full contact and shipping details were exposed for 11,742 Trezor customers, with partial data exposed for another 1,947.
- Trezor says its devices, wallet infrastructure and private keys were not compromised.
- The leaked information creates targeted phishing and privacy exposure through a supplier outside Trezor’s core security architecture.
A breach at fulfilment provider ShipMonk has exposed personal information belonging to 13,689 customers of Trezor, showing how a hardware wallet can remain technically secure while its owners are exposed through the surrounding logistics chain.
ShipMonk informed Trezor on 10 August that an unauthorised actor had accessed customer order data. Trezor subsequently identified 11,742 customers whose names, email addresses, telephone numbers and full shipping addresses were exposed, while another 1,947 had names, cities and email addresses affected.
The records relate to orders sent to customers in the UK, Sweden, Italy, Portugal, the United States, Brazil and Colombia. Trezor says its own wallet infrastructure, devices and private keys were not compromised.
That separation is important because the core purpose of a hardware wallet is to keep cryptographic keys isolated from more exposed online systems. Nothing disclosed about the ShipMonk incident indicates that an attacker gained the ability to access cryptocurrency directly through compromised Trezor firmware or keys.
The information that was exposed can nevertheless be unusually useful for targeted social engineering. An attacker no longer has to guess whether a person owns a hardware wallet or which brand they use. Messages about firmware updates, wallet recovery, account verification or delivery problems can be tailored to a known product relationship.
Full residential addresses add a second layer of sensitivity. Cryptocurrency owners can face physical as well as digital security risks because possession of a hardware wallet may imply control of assets that cannot be recovered through a bank or payment provider after theft. Exposure of an address does not mean a customer will be physically targeted, but it removes information that many users would reasonably prefer to keep separate from their holdings.
The incident also expands the usual definition of supply chain security. Technology companies commonly place security scrutiny on cloud infrastructure, software dependencies and payment providers, while logistics services can appear further removed from the protected product. In practice, fulfilment providers can hold names, addresses, telephone numbers, purchasing records and product details with their own security value.
Retention becomes part of that risk. Once a product has been delivered, businesses and their suppliers may have different legal and operational reasons for keeping order data. Historical information nevertheless remains a target if it continues to sit in systems accessible to a compromised supplier account or environment.
Trezor’s architecture may therefore have done exactly what it was designed to do while a separate dependency still produced a security incident for customers. Modern products operate inside networks of fulfilment providers, analytics services, support platforms and payment processors, each of which can create a distinct path to exposure.
European data-protection obligations add further accountability where the affected information concerns identifiable customers. Controllers remain responsible for assessing the processors and suppliers used to handle personal data, while contractual arrangements do not remove the need to understand which data is retained downstream.
Trezor has warned customers about phishing following the breach. That response reflects the most immediate digital risk because attackers can use genuine order information to make fraudulent communications more convincing without ever compromising a wallet.
The incident is consequently less about a failure in cryptocurrency custody than a failure of the data boundary around it. Hardware security can protect keys, but it cannot protect personal information copied into an external supplier’s fulfilment system.
