Trezor Leak of Customer Data: When a Shipping Leak Becomes a Physical Threat

Trezor disclosed on August 13 that ShipMonk, a third-party fulfillment partner, suffered a data breach exposing customer order data. Names, email addresses, phone numbers and shipping addresses of 11,742 customers were accessed, along with partial data—name, city and email—for another 1,947, roughly 13,689 people in total across the U.S., UK, Sweden, Colombia, Brazil, Italy and Portugal. Trezor’s own systems and devices were not compromised. It is the first breach in the company’s history to expose customer phone numbers and home addresses.

Why home addresses matter more than they might appear, a London courtroom explained just weeks earlier.

At Inner London Crown Court, a jury convicted five men over the 52-hour false imprisonment of two French cryptocurrency millionaires. Gerson Borges and Mohamed Osman were found guilty of conspiracy to blackmail and false imprisonment; Julius George and William Adebisi were convicted of false imprisonment, and Isaac Bakoya admitted the same charge. The gang demanded $150,000 and received roughly $30,000 in crypto. Notably, prosecutors secured the convictions without either victim testifying—both were too afraid of the gang to appear. Sentencing is set for September.

How were the victims selected? Prosecutors said their lifestyles had been widely publicized on social media. These “wrench attacks”—coercing the holder rather than compromising the wallet—are climbing sharply: CertiK verified 52 worldwide in the first half of 2026, 39 of them in Europe, representing roughly $124 million in exposure.

That is the shift the ShipMonk breach represents. Social media requires an attacker to infer who holds crypto. A leaked fulfillment database removes the inference, pairing a confirmed hardware wallet purchase with a home address and phone number.

Frequently Asked Questions

Was Trezor itself hacked? No. The breach occurred at ShipMonk, a third-party fulfillment provider. Trezor has stated its own systems were not compromised and that hardware wallets and devices remain secure. What leaked was order and shipping data — not wallet credentials, recovery seeds, or funds.

What information was exposed? For 11,742 customers: full name, email address, phone number, and shipping address. For another 1,947 customers: name, city, and email address only. Roughly 13,689 people are affected across the U.S., UK, Sweden, Colombia, Brazil, Italy, and Portugal.

How do I know if I'm affected? Trezor says every affected customer has been contacted directly by email from its official security address. If you did not receive a notification, you are not affected. Be cautious: scammers are likely to send fake "breach notification" emails — verify anything you receive against Trezor's official blog and support channels before clicking.

What is a "wrench attack"? A wrench attack is the use of physical force or threats against a person to make them hand over cryptocurrency, rather than hacking their wallet. The name comes from the observation that a $5 wrench can defeat security that no computer can. Blockchain security firm CertiK verified 52 such attacks worldwide in the first half of 2026, with roughly $124 million in recorded exposure.

Does a shipping data leak really increase the risk of physical attack? It changes the targeting math. Publicly flaunted wealth requires an attacker to guess who holds crypto. A leaked hardware wallet order pairs a confirmed purchase with a verified home address and phone number. No misuse of this specific dataset has been confirmed, but prior wallet-vendor leaks have fueled years of phishing, extortion letters, and in-person threats.

What should affected customers do now? Treat unexpected emails, calls, texts, and physical mail about your crypto holdings as hostile until verified. Never enter your recovery seed on any website or share it with anyone — no legitimate company will ever ask. Consider whether deliveries of security devices to your home address are worth the exposure; P.O. boxes and anonymized delivery options reduce it.