Third-party breach exposes shipping addresses of 14,000 Trezor buyers

The hardware wallet maker confirmed its devices are safe and no stolen data has appeared for sale yet, but warned users in seven countries of phishing risks.

Third-party breach exposes shipping addresses of 14,000 Trezor buyers

Tech

Trezor warns 14,000 customers after fulfilment partner suffers data breach

The incident marks the first time Trezor customers' shipping addresses were exposed.

By

Olivier Acuna

|

Edited by

Cheyenne Ligon

3 hrs ago

3

min read

Make

preferred on

Share

Share this article

Copy link

X icon

X (Twitter)

LinkedIn

Facebook

Email

Make

preferred on

People affected by companies' data breaches remain at risk of scams for years after the security break actually takes place. (geralt/Pixabay)

Summary

Show

Trezor said nearly 14,000 customers had personal data exposed after its fulfillment partner ShipMonk suffered an unauthorized access to its systems, though its own infrastructure and wallets remain secure.

The breach, the first in Trezor’s history to expose customer phone numbers and shipping addresses, increases the risk of phishing and other scams even though no misuse of the leaked data has yet been confirmed.

The incident underscores a broader rise in global data breaches and follows earlier third-party leaks affecting Trezor and rival hardware wallet maker Ledger, which have led to long-running phishing and extortion campaigns.

ShipMonk, Trezor’s fulfillment partner, suffered unauthorized access to its systems, affecting nearly 14,000 customers’ data, the

cold storage crypto wallet firm reported Thursday

.

Trezor said the names, email addresses, phone numbers and shipping addresses of 11,742 customers had been compromised. It also said the names, cities and email addresses of another 1,947 customers were also breached, bringing the estimated number of victims to nearly 14,000 across the U.S., the UK, Sweden, Colombia, Brazil, Italy and Portugal.

"We have some difficult news to share,"

Trezor said Thursday on X

. "Unfortunately, one of our shipping providers has experienced a data breach that exposed sensitive order data."

The Trezor-related security hack comes as global data breaches are at an all-time high, according to

SentinelOne, a U.S. cybersecurity firm

. It said that this year, data breaches have increased by 17% compared with 2025, with an average of 2,090 attacks worldwide each week. It is also estimated that global data breaches have been rising by 3% month over month since January.

The cold storage wallet manufacturing firm said it notified all affected customers via email, adding that the data of those who did not receive the message was not compromised. Trezor told CoinDesk via email it has no confirmed cases of the exposed data being published, shared, or offered for sale yet. It also said it is unaware of any scam or hack attempt linked to the incident so far. Customers who purchased through Amazon are not affected, as those orders are fulfilled by a separate partner, it added.

Trezor also said its own systems were not compromised, and crypto wallet devices remain secure. The risk is indirect, it added, saying affected customers are now more likely to be targeted by phishing attempts via email, phone, or post. Scammers could use the leaked data to impersonate banks, crypto exchanges, or Trezor itself.

People whose data is stolen in a data breach remain at risk for years after the hacking event. Once stolen logistics records are sold or published online, cybercriminals continually repurpose the data for new scams. Extortionists have

leveraged home addresses to demand $700 to $1,000

in ransom and mail counterfeit devices directly to victims. Managing the long-tail legal, remediation, and brand fallout from a major customer leak is estimated to

cost hardware firms over $33 million

.

Crypto holders are also increasingly at risk of physical attacks. In-person coercion attacks

have totalled $124 million in the first half of this year alone,

although not all can be traced back to a data breach, according to Certik. Cybersecurity firm DeepStrike

estimated the amount

of money people lose to data breaches into the tens of billions of dollars yearly.

Trezor said this was the first breach in its 13-year history to expose customer phone numbers and shipping addresses. However, Satoshi Labs, the company behind Trezor,

reported that a third-party support portal’s security

had been breached in January 2024, affecting 66,000 people. Another 106,856

Trezor customers’ data was compromised in April 2022

. Trezor’s internal firmware and on-device cryptography have never been breached remotely to steal funds.

Ledger, the maker of one of the most popular hardware wallets in crypto,

suffered a data breach in January.

The security breach was linked to its third-party e-commerce partner, Global-e. In 2020, Ledger

suffered another large-scale breach

affecting nearly 300,000 users. A year later,

scammers sent fake Ledger devices

to victims of that breach in a follow-on phishing campaign.

Data Breaches

Ledger

Latest Crypto News

1

Tether says it completed long-promised 'Big Four' audit of finances behind $180 billion USDT stablecoin

2 hrs ago

2

Crypto for Advisors: The crypto advice gap

6 hrs ago

3

B2C2 taps Schroders veteran to chase Asia’s growing crypto wealth

6 hrs ago

4

Kalshi in talks with Sequoia, Wellington for $750 million fund raise at $40 billion valuation

6 hrs ago

5

Swissquote cuts full-year guidance as 1H crypto income plunges, shares slide

7 hrs ago

6

Crypto platform operator gets 15-year prison sentence in South Korea due to $50 million scam

7 hrs ago

7

Figure revenue doubles as blockchain loan marketplace volumes surge

7 hrs ago

8

Bullish shares surge 14% as subscription revenue offsets digital asset slowdown

8 hrs ago

9

Strategy, Metaplanet unrealized bitcoin losses highlight risk of concentrating on just one token

9 hrs ago

10

Bitcoin holds steady near $64,000 as monero, hyperliquid outperform

10 hrs ago

Latest Research

Building the Zcash Machine: Tachyon and Quantum Readiness

Building the Zcash Machine: Tachyon and Quantum Readiness

Zcash’s Tachyon upgrade aims to scale shielded payments, improve quantum readiness, and test whether its funding, security, and governance can hold.

By

CoinDesk Research

Jun 30, 2026

Commissioned by

GenZcash

Zcash’s Tachyon upgrade aims to scale shielded payments, improve quantum readiness, and test whether its funding, security, and governance can hold.

Why it matters

:

Zcash’s Tachyon upgrade aims to scale shielded payments, improve quantum readiness, and test whether its funding, security, and governance can hold.

View Full Report

More From

Tech

Live updates: Bitcoin slips back even as Fed rate hike expectations dwindle

Bitcoin firms ask AI labs for same tools attackers already have

Miden bets on privacy stablecoins with introduction of USDCx

Crypto

CD20

$1,738.62

CD20 up 0.11 percent

0.11%

BTC

$63,354.01

BTC down 0.094 percent

0.094%

ETH

$1,884.65

ETH up 0.43 percent

0.43%

XRP

$1.01

XRP up 0.39 percent

0.39%

SOL

$76.16

SOL up 0.98 percent

0.98%