Trezor Data Breach: ShipMonk Hack Exposes 13,700 Records

Trezor called the event the first breach since its 2013 founding to expose phone numbers and shipping addresses. The company said it understands how serious the situation is, acknowledging the risk to affected customers. Support channels remain open.

Binance co-founder Changpeng Zhao commented on the incident, noting hardware wallets are generally seen as more secure than software options. He said the breach shows an advantage of software self-custody tools, which skip shipping a device tied to identity. Zhao added, “Not saying hardware wallets are ‘bad’. Just different risk profiles.”

Trezor urged affected customers to treat unexpected emails, calls, or letters with caution. The company recommended checking any communication against its official blog and social channels before responding. Customers were reminded never to enter a wallet recovery phrase online or share it with anyone.

Trezor outlined steps buyers can take to reduce data exposure on future orders: use an email address not linked to a real identity, pay with crypto or disposable cards, or use a P.O. Box. The company also announced an upcoming Anonymous Delivery option built to reduce identity exposure during shipping. The feature uses a dedicated checkout, locker pickup, and neutral packaging with no visible sender name. Trezor plans to launch the option in the European Union by September 2026 and in the United States by year-end.

Trezor reiterated that no company systems, products, or services were affected by the ShipMonk breach. Devices already in customers' hands remain secure, and private keys were never exposed. The main risk going forward, Trezor said, is an increase in targeted phishing attempts.