Trezor Breach Exposes 13,689 Hardware Wallet Buyers: Names, Addresses Leaked

Trezor confirmed this is the first breach since the company was founded in 2013 to expose customer phone numbers and shipping addresses. A separate January 2024 incident at a third-party support portal exposed contact details of nearly 66,000 users, though not physical addresses.

The Ledger precedent

The crypto industry already has a playbook. When roughly 272,000 Ledger customer records including names, addresses and phone numbers were published following that company’s 2020 e-commerce breach, the fallout never really ended. Victims reported waves of phishing emails and SMS, counterfeit hardware wallets mailed to their homes in 2021, physical letters with malicious QR codes, and phone calls from people who spoke as though they knew them personally. Some received ransom demands with threats of violence.

CertiK verified 52 physical attacks on crypto holders worldwide in the first half of 2026, up from 39 a year earlier. Home invasions overtook kidnapping as the most common method. Chainalysis put the amount stolen through violent attacks at more than $30 million over the same period, on pace to pass 2025’s full-year total of roughly $58 million.

Vendors keep proving to be the weakest link. Ledger’s payment processor Global-e leaked customer order data in January 2026. Within days, attackers sent phishing emails announcing a fake Ledger and Trezor merger, personalized with the leaked order details. ShipMonk holds SOC 2 Type II certification, an audited security standard, and was breached regardless.

Trezor’s guidance is short, and the industry track record says it works. Trezor tells customers to ignore any unsolicited contact that references their purchase. The company never calls customers. It never sends hardware through third parties. It never asks for a seed phrase. Anyone who receives a message with a link should visit trezor.io directly. Entering a recovery seed into a computer, phone or website is never necessary. The only place the seed belongs is the hardware device itself. Anyone who wants to check status or raise a concern can contact Trezor support through the official site.

Trezor says it is accelerating an Anonymous Delivery option designed to break the link between a hardware wallet purchase and a real-world identity. Under the planned system, orders would use a randomized shipping label format that replaces the customer name with a code and strips the return address to a generic Trezor distribution center. Trezor targets availability in the EU by September 2026 and in the US by the end of 2026. The company describes the project as a top priority. In the meantime, Trezor suggests ordering with an email address not linked to your real identity, paying with crypto or a disposable virtual card, and using a P.O. Box where practical.