A compromise at a third-party logistics company has forced Trezor to warn thousands of customers that information associated with their hardware wallet purchases may now be in the hands of attackers.
Summary:
Personal information tied to 13,689 Trezor orders was exposed after hackers accessed systems belonging to ShipMonk
The incident involved customer identities and delivery details, but not crypto credentials or wallet devices
Trezor is developing a privacy-focused delivery system following the breach
The affected company is ShipMonk, which handled delivery data for Trezor orders. According to Trezor, the incident covers customers who received packages within the 90 days preceding August 8, 2026, in the United States, United Kingdom, Sweden, Colombia, Brazil, Italy, and Portugal.
The scale of exposure varies. Records belonging to 11,742 people contained their name, email, phone number and shipping address. For an additional 1,947 customers, the compromised records included a name, city and email address.
The breach therefore does not give criminals direct access to cryptocurrency. Trezor said there was no compromise of its products, internal systems, private keys or wallet recovery information.
The concern is what the leaked records reveal indirectly. A person's name combined with a delivery address and evidence of a Trezor purchase can identify them as a potential cryptocurrency holder. That information could subsequently be used to construct convincing impersonation attempts or targeted social-engineering schemes.
Trezor has advised customers to assume that unsolicited communications could be fraudulent and reiterated that recovery phrases should never be provided to support representatives, websites or other third parties.
The company is also changing its approach to order fulfillment. Trezor plans to introduce anonymous delivery in the EU in September and in the U.S. later in 2026. The proposed system will allow customers to use an alias or identifier, collect packages from automated lockers and receive unbranded packaging. Delivery identifiers are also expected to be removed after the package is received.
Trezor said ShipMonk has already taken measures to secure the affected infrastructure, while both companies continue investigating the breach. The incident demonstrates that protecting a crypto wallet involves more than securing its private keys: information created when the device is purchased can also become a security liability.