Trezor Warns 11,742 Customers After ShipMonk Breach Exposes Addresses

"Our systems and devices remain secure, but affected customers could experience an increase in phishing attempts," the company said. "NEVER enter your wallet backup on a website or share it with anyone, and only check for updates on official Trezor channels."

Trezor’s 90-day data retention policy limited the scope. The policy requires fulfillment partners to delete or anonymize customer information after three months, so older orders were not in ShipMonk’s database at the time of the breach.

Trezor said it is working with ShipMonk to determine exactly what data was accessed and how. ShipMonk has secured the affected systems and added additional security measures, according to Trezor.

For hardware wallet users, the exposure of shipping addresses and phone numbers opens a new vector for social engineering. Attackers who pair the leaked order details with a spoofed Trezor support call or a fake firmware update email could make phishing attempts harder to spot. Trezor has previously warned users never to share seed phrases, and this breach raises the stakes for that advice.

The breach did not extend to payment card data or wallet credentials, Trezor said. The company did not disclose how long the unauthorized access lasted or whether law enforcement has been notified.