Trezor shipping partner breach leaks data of 13,689 customers

With that information, attackers could impersonate Trezor, a cryptocurrency exchange, or a financial institution through email, phone, or mail. Trezor said the breach is limited because of its 90-day data storage policy. No wallet backups, private keys, or payment data were exposed.

The incident follows a separate vulnerability at Coldcard, a competitor in hardware wallets. Coldcard had a flaw in wallet seed creation. By August 5, attackers had stolen 1,816 BTC – roughly $116 million – through that exploit, according to TRM Labs. The two cases differ: Coldcard involved a direct wallet flaw, while Trezor's breach occurred at a third-party shipping provider and exposed customer identities, not keys.

Hardware wallet owners are frequent targets of social engineering because they may hold significant cryptocurrency. A convincing email or phone call referencing a customer's name and address could trick them into revealing their recovery seed or transferring funds. Trezor's advisory warned users to treat any unsolicited communication claiming to be from the company as suspicious.

Trezor said it has contacted affected customers directly and urged all users to verify any contact through official channels only. The company did not say whether it would change shipping providers or data retention policies as a result of the breach.