Trezor Says Shipping Breach Exposed 13,689 Customers

Trezor Says ShipMonk Exposed 11,742 Full Customer Records

The company said ShipMonk held the data to fulfill deliveries. For the 11,742 customers in the full-exposure group, that information included a name, email, phone number and physical shipping address. Trezor’s more detailed FAQ also says ShipMonk retains the order number needed for delivery.

Trezor described its 90-day retention rule as the reason the exposure is limited. Its privacy policy says completed or canceled e-shop order data is deleted after 90 days, with exceptions for ongoing order problems, while invoice data is kept separately for legal requirements. The company said it requires the same deletion or anonymization standard from fulfillment partners.

That policy does not erase the risk for the people whose data was still in ShipMonk’s systems. The combination of a real name, address, phone number, email and an apparent hardware-wallet purchase gives an attacker enough context to impersonate a delivery firm, bank, exchange or Trezor support with a higher chance of being believed.

The disclosure is separate from the seed-generation flaw and documented thefts in the recent Coldcard incident. Trezor has not reported a device weakness, exposed seed phrase or unauthorized transfer here. It says ShipMonk secured the affected systems and hardened security, while the companies continue to investigate what happened.

No Wallets or Keys Reported Compromised, but Phishing Risk Rises

Trezor’s clearest message is that an exposed address does not itself give anyone access to a wallet. Its notice says its systems were not compromised and Trezor devices remain secure. A recovery phrase or wallet backup, not a shipping record, is the secret that can recreate a wallet and authorize a theft.

But attackers do not always need a technical break. Earlier this year, BleepingComputer documented postal phishing letters that used urgent device-verification claims and QR codes to send hardware-wallet users to seed-phrase phishing sites. The reporting said those sites ultimately asked people to enter their recovery words.

That is why an apparent support message should not be treated as trustworthy just because it includes a correct address or order detail. Trezor says customers should be suspicious of communications demanding immediate action or personal information and should cross-check messages with official company channels. Its scams and phishing guidance is unequivocal: a user should never enter a wallet backup on a website or share it with anyone.

The same operational lesson applied in Daily Crypto Briefs’ coverage of fake wallet apps aimed at Ledger and Trezor users. The risky moment is often not a dramatic device compromise; it is the point when a frightened user types recovery words into a convincing form or approves a malicious action.

What Affected Trezor Buyers Should Watch for Now

Affected customers should not use links or phone numbers contained in an unexpected message. Instead, they should open a trusted browser bookmark or type Trezor’s official address manually, then use the company’s documented support path. Any request to “verify,” “sync,” “upgrade,” photograph or upload a recovery phrase should be treated as fraud.

The company says buyers who placed direct Trezor Shop orders and received a notice from [email protected] are affected. A Trezor representative also said in a public follow-up that orders through its official Amazon stores use a different fulfillment partner and are not involved. Customers uncertain about a specific order should rely on the company’s official support page, rather than replying to a message that claims to be a breach notice.

Trezor says it plans an Anonymous Delivery option with locker pickup, neutral packaging and automatic deletion of shipping identifiers after delivery, targeting the European Union by September and the United States by year-end. That is a planned mitigation, not a fix for information already exposed.

The Crypto Fear & Greed Index read 29, or Fear, on Aug. 13. It is not evidence that the breach moved the market, but it provides a cautious backdrop for an event in which the urgent reader concern is account and physical-security hygiene, not token price.

As of publication, Trezor has not disclosed an attacker identity, a cause beyond unauthorized access at ShipMonk, a financial-loss total or a confirmed phishing campaign using this data. Those are the updates worth watching. For now, the verified facts are narrower but serious: roughly 13,689 people had personal data exposed, the wallet maker says keys and devices were not compromised, and the most immediate danger is a more believable attempt to make an affected buyer surrender the one secret that matters.