Trezor ShipMonk Breach: 13,689 Customers Exposed in Fulfillment Hack

Such attacks have previously targeted hardware wallet owners using personal information and official-looking communications. In February, fake letters sent to Trezor and Ledger customers directed recipients to phishing websites through QR codes. The letters told recipients they needed to complete an authentication or transaction check and warned about possible problems with wallet functionality. The linked phishing pages requested 12-, 20- or 24-word recovery phrases, which would give attackers control over a wallet once submitted.

Physical letters present a particular concern when attackers already possess a victim’s mailing details. An April 2025 Ledger phishing campaign involved fraudulent letters carrying Ledger branding, a business address and individual reference numbers. Recipients were instructed to scan a QR code and provide their 24-word recovery phrase under the claim that a critical security update was required.

Trezor has told affected customers to treat communications demanding immediate action or personal information with suspicion. It advised users to verify messages against its official communications and never provide a wallet backup through a website or to another person.

Trezor has dealt with customer information exposure through third-party services before, although the company said the ShipMonk incident was its first involving leaked phone numbers and shipping addresses.

In January 2024, an unauthorized party accessed a third-party support ticket portal used by Trezor, potentially exposing contact information belonging to about 66,000 customers who had interacted with the support team since late 2021. The company notified affected contacts at the time and said digital assets had not been compromised.

Another phishing method emerged in June 2025 when attackers abused Trezor’s contact form by submitting support requests using targeted users’ email addresses. The process triggered legitimate automated replies from Trezor’s system, making the resulting phishing communications appear more credible. Trezor said its email infrastructure had not been breached and the contact form remained secure.

Hardware security has separately remained under scrutiny. In June, Trezor and Tropic Square disclosed a chip flaw affecting the TROPIC01 Secure Element used in the Trezor Safe 7 after researchers from Ledger Donjon found the weakness during an independent audit. Ledger Donjon used laser fault injection under laboratory conditions to extract some chip secrets and bypass firmware signature checks. Trezor said the attack required physical access and specialized equipment, while two other independent security layers continued to protect access to the wallet. Users were not required to take action.

The ShipMonk incident, by comparison, involved order information held by a fulfillment provider rather than the hardware or software responsible for securing private keys.

Following the latest disclosure, Trezor also detailed ways customers can reduce the amount of personal information connected to future hardware wallet purchases. The company recommended using an email address not linked to a customer’s primary identity and suggested cryptocurrency payments as an alternative to credit cards. Where available, customers can also use a P.O. Box to reduce the exposure of their home address, although identification requirements and postal service records may still apply.

Trezor is also preparing an Anonymous Delivery service designed to reduce the customer information retained during hardware wallet shipments. Under the planned system, orders would use a dedicated checkout process, locker collection, neutral packaging and generic sender information. Shipping identifiers would then be automatically deleted after delivery. Trezor said it plans to make Anonymous Delivery available in the European Union by September 2026, followed by a U.S. rollout by the end of 2026.