Crypto▼ Bearish
Trezor Data Breach Exposes 13,689 Hardware Wallet Buyers' Home Addresses
Trezor said ShipMonk exposed 13,689 customer records, including home addresses of 11,742 hardware wallet buyers. Chainalysis data shows crypto home invasions hit a record $58 million in 2025.
Continue with
On Aug. 13, Trezor said a breach at the fulfillment provider ShipMonk exposed customer data for about 13,689 hardware wallet buyers, including the delivery addresses of 11,742 people.
The larger group had their names, email addresses, phone numbers, and shipping addresses exposed. Another 1,947 customers had names, cities, and email addresses compromised. ShipMonk handled the information to fulfill and deliver Trezor orders.
Trezor said its own systems, devices, and services were not breached and that customer wallets remain secure. The exposure instead creates a different risk: linking identifiable people and, in most cases, their home addresses to the purchase of a hardware wallet designed to secure crypto holdings.
ShipMonk notified Trezor on Aug. 10 that an unauthorized actor had accessed systems containing customer information, according to the company's Aug. 13 disclosure.
The 11,742 fully exposed records covered orders received between May 10 and Aug. 8. The additional 1,947 records may include older purchases. Trezor said it was still working with ShipMonk to determine why those records remained available.
Trezor said its fulfillment partners are generally required to delete or anonymize order information within 90 days of delivery, limiting how much recent customer data remains accessible after an order is completed.
While the exposed records do not provide access to wallets or private keys, they can make phishing and other attacks substantially more targeted. Trezor warned that scammers could use the information to impersonate the company, banks, or crypto exchanges through convincing emails, phone calls, and letters. An attacker who already knows that a person bought a Trezor device can tailor a message around wallet security, compromised funds, or supposed account problems rather than relying on generic phishing tactics.
The inclusion of delivery addresses raises a more serious concern because it can identify households associated with people who are likely to own crypto.