Trezor, one of the oldest names in cryptocurrency hardware wallets, has confirmed that a data breach at a third-party shipping partner is far bigger than first disclosed. On September 4, 2026, the company said the incident tied to fulfillment provider ShipMonk now affects 67,000 additional US customers, on top of the roughly 14,000 users it first warned about in mid-August. The exposed records include names, email addresses, phone numbers, shipping addresses, and order details tied to purchases made between November 2019 and August 2021, according to Trezor’s own disclosure and reporting from Bloomberg News.
No private keys, seed phrases, or on-device wallet credentials were touched, Trezor says, because that information never leaves the physical device and was never stored in ShipMonk’s systems. But for a company whose entire business model rests on customer trust in a small metal-and-plastic box that guards a person’s crypto holdings, a leak of real names tied to real shipping addresses is its own kind of five-alarm fire. It hands criminals exactly the raw material needed to run convincing, targeted phishing campaigns against people who are already known to own cryptocurrency, and it lands squarely within the pattern of 2026’s broader wave of vendor and supply-chain data breaches.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What Trezor Confirmed on September 4
In its own words, posted to its blog, Trezor said: “We’re extremely sorry to inform our community that customer personal information, including full names, phone numbers, email addresses, and shipping addresses, has been accessed by an unauthorized actor during this breach,” according to Trezor’s official incident disclosure. The company traced the origin of the breach to ShipMonk, the third-party logistics and order-fulfillment firm it uses to ship hardware wallets to customers, rather than to any weakness in its own device firmware, manufacturing pipeline, or wallet software.
Trezor also laid out exactly when it learned about the problem: “On Monday, August 10, 2026, one of our shipping providers, ShipMonk, informed us of unauthorized access to their systems containing customer data,” the company said in the same disclosure. That timeline matters, because it shows a roughly three-and-a-half-week gap between the initial notification from ShipMonk and Trezor’s public warning to affected customers, and then a further gap of nearly three weeks before the scope of the breach was revised sharply upward on September 4.
Bloomberg News, which broke the story of the expanded impact, reported the specifics of who was affected in the newest disclosure: “The customers, who made orders between November 2019 and August 2021, had full details including their names, email addresses, phone numbers and shipping address exposed,” per Bloomberg’s report on the widened breach. That window covers nearly two years of Trezor’s US order history, meaning anyone who bought a hardware wallet directly from the company during that period should assume their shipping data was part of the exposed dataset.
Timeline: From a Quiet August Warning to a Public Reckoning
The Trezor-ShipMonk breach did not arrive as a single, clean announcement. It unfolded in stages, each one widening the scope of who was affected and how bad the exposure actually was. Trezor’s first public acknowledgment came via a post on X in mid-August, where the company wrote plainly: “We have some difficult news to share,” followed by the specifics: “Unfortunately, one of our shipping providers has experienced a data breach that exposed sensitive order data,” according to CoinDesk’s coverage of the original warning, which put the initial affected population at around 14,000 users.
Three weeks later, that number jumped by a factor of nearly five. Adding the two disclosed figures together, at least 81,000 people have now been told their personal information was exposed through the ShipMonk incident, though Trezor has been careful to frame the two groups as distinct cohorts rather than issue a single running total.
| Date | Event | Disclosed Impact |
|---|---|---|
| August 10, 2026 | ShipMonk notifies Trezor of unauthorized system access | Not yet public |
| August 13, 2026 | Trezor posts initial public breach warning on X | ~14,000 users |
| Late August 2026 | ShipMonk continues forensic review of compromised systems | Scope under investigation |
| September 4, 2026 | Trezor discloses expanded impact; Bloomberg reports widened breach | 67,000 additional US customers |
| September 4-5, 2026 | Crypto and cybersecurity press pick up expanded disclosure | 81,000+ combined across both rounds |
What Data Was Exposed — and What Wasn’t
Exposed: Shipping and Order Records
The categories of data confirmed as exposed are consistent across Trezor’s own statement and Bloomberg’s reporting: full names, email addresses, phone numbers, physical shipping addresses, and order details. This is the kind of information a fulfillment vendor needs to print a shipping label and process a return, not anything related to wallet security itself. But in the context of a company whose customers are, by definition, people who hold cryptocurrency, that combination of data is unusually valuable to criminals.
Not Exposed: Wallets, Keys, and Seed Phrases
Trezor has repeatedly stressed that its production systems, firmware, and wallet infrastructure were not part of the breach. Seed phrases, the 12-to-24-word recovery codes that control access to a wallet’s funds, are generated and stored only on the physical hardware device itself and are never transmitted to or stored on Trezor’s servers, let alone a shipping partner’s systems. The same is true of private keys. In principle, this means no cryptocurrency was directly stolen as a result of the ShipMonk incident itself.
That distinction is technically accurate, but it undersells the real risk. Hardware wallets are designed to be resistant to remote attacks precisely because the attack surface that matters, the seed phrase, never touches the internet. What this breach opens up is a different and arguably more dangerous door: it hands attackers a verified list of people who own hardware wallets, along with enough personal detail to make a phishing attempt look legitimate.
Why a Shipping Company, Not Trezor Itself, Is at the Center
ShipMonk is a third-party order fulfillment provider used by e-commerce brands to handle warehousing, packing, and shipping logistics, rather than a cybersecurity or crypto company. That is precisely the point security researchers keep making about incidents like this one: a company can lock down its own core product with hardware-level security and still be exposed through a vendor several steps removed from the product itself. The Verizon Data Breach Investigations Report has tracked a steady rise in breaches that originate through third-party and supply-chain relationships rather than a direct attack on the primary target, and the Trezor-ShipMonk incident fits that pattern closely.
Trezor’s disclosure also raises a question that tends to follow every vendor breach: how long should a fulfillment partner retain order records from customers who bought a product years earlier? The affected window, November 2019 through August 2021, means some of this data sat in ShipMonk’s systems for close to seven years before it was exposed. Longer retention windows mean more historical data sitting in a system that only needs to be breached once.
The Real Danger Is Phishing, Not a Drained Wallet
Security teams that responded to the 2020 breach of rival hardware wallet maker Ledger, which exposed roughly one million customer email addresses and around 270,000 physical mailing addresses in a marketing database, watched what came next for more than two years: a sustained wave of phishing emails, fake wallet-recovery apps, and even physical letters mailed to Ledger customers’ home addresses instructing them to plug in a “replacement device” that was actually designed to steal seed phrases. Some victims lost six-figure sums to attacks that referenced their real name, real order number, and real address to appear legitimate.
That history is the lens through which the Trezor-ShipMonk breach should be read. A phone number and a home address tied to a confirmed hardware wallet purchase is enough for an attacker to run a highly targeted SMS phishing (smishing) campaign, or in the more elaborate playbook seen with Ledger customers, to mail a physical package designed to look like an official Trezor security update. Because the exposed data confirms someone owns cryptocurrency worth protecting, these victims are pre-qualified targets in a way that a random phishing blast never achieves.
Comparing the Trezor and Ledger Vendor Breaches
| Detail | Trezor / ShipMonk (2026) | Ledger (2020) |
|---|---|---|
| Source of breach | Third-party shipping/fulfillment vendor | Third-party e-commerce/marketing database |
| Disclosed victims | ~14,000 (Aug.) + 67,000 (Sept.) = 81,000+ | ~1,000,000 email addresses; ~270,000 with physical addresses |
| Data exposed | Name, email, phone, shipping address, order details | Name, email, phone, physical address (subset) |
| Wallet/keys compromised | No — device-only storage untouched | No — device-only storage untouched |
| Known follow-on abuse | Under active monitoring as of Sept. 2026 | Years of targeted phishing and fake hardware scams |
The parallel is not exact. Ledger’s exposure was roughly an order of magnitude larger in raw numbers, and it stemmed from a marketing database rather than a shipping vendor. But the shape of the risk is the same: hardware security can be flawless and still be undermined by a much weaker link in the customer data supply chain. That’s a lesson the entire crypto hardware industry has now had to learn twice in six years.
Market and Industry Reaction
Trezor, made by Czech company SatoshiLabs, was the first company to ship a commercial hardware wallet in 2014, and it remains one of the two dominant brands in the category alongside Ledger. A breach at either company draws outsized attention because the two firms effectively define consumer trust in the entire cold-storage hardware wallet market. Crypto-focused outlets including CoinDesk and Bloomberg moved quickly to cover the expanded disclosure, a sign of how closely the security posture of wallet makers is watched by both retail holders and institutional custody desks that rely on similar hardware for cold storage.
There is also a reputational dimension that goes beyond the immediate victims. Every hardware wallet vendor markets itself on the premise that its supply chain, from manufacturing to shipping to the customer’s door, is trustworthy end to end. A breach at a shipping partner, even one that leaves the actual wallet security untouched, chips away at that broader promise. For a company competing against not just Ledger but a growing field of newer entrants, that kind of reputational cost can be harder to quantify than a direct financial loss, but it is not smaller. It also lands in a year when crypto-adjacent security scares, including the fears around AI-assisted crypto theft that followed reports tied to Claude Fable, have already put crypto holders on edge about where the next threat to their holdings might come from.
Third-Party Vendor Risk Keeps Getting Worse Across Tech
The Trezor-ShipMonk incident lands in the middle of a broader pattern that has defined 2026’s cybersecurity news cycle: breaches that start at a vendor, contractor, or fulfillment partner rather than the named company itself. Security teams increasingly describe this as the “fourth-party problem,” where an organization can audit its own vendors but has little visibility into what those vendors, in turn, outsource to. Krebs on Security has documented numerous cases where breach notifications traced back not to the brand customers recognized, but to a data processor several steps removed from the original transaction.
Tech Insider has covered several related incidents this year, including the IDScan.net breach that fed a dark-web identity marketplace called Nexus and the Dropbox accounts compromised through a Lenovo ID authentication weakness. Both cases share the same structural problem as the Trezor breach: a company’s own systems held up fine, while an integration point with an outside partner became the point of failure.
What Trezor Customers Should Do Right Now
Trezor’s guidance to affected customers centers on treating any unsolicited contact referencing their order as suspicious by default, even if it includes accurate personal details. The company’s core message is that it will never ask a customer for their seed phrase, recovery words, or PIN, under any circumstance, including customer support interactions. The checklist below reflects the practical steps security researchers recommend to anyone who bought a Trezor device between late 2019 and mid-2021.
Trezor / ShipMonk breach response checklist:
[ ] Never enter your seed phrase into any website, app, or device prompt
[ ] Treat any "security update" package or email as suspicious unless verified directly on trezor.io
[ ] Do not click links in unexpected emails referencing your Trezor order number
[ ] Verify any support contact through Trezor's official channels only
[ ] Watch for SMS or phone-call phishing referencing your name, address, or order date
[ ] Consider a hidden wallet / passphrase feature for an added recovery layer
[ ] Report suspicious contact to Trezor support and to the FTC or IC3
[ ] Monitor your email and phone number for signs of targeted spam campaignsAnyone who believes they have received a targeted phishing attempt tied to this breach can file a report with the FBI’s Internet Crime Complaint Center, which tracks cryptocurrency-related fraud reports separately from general cybercrime complaints. The FTC’s data breach response guidance also outlines the standard steps consumers should take after any breach involving personal contact information, including placing a fraud alert if identity theft, rather than just phishing, becomes a concern.
Regulatory and Legal Exposure Ahead
Because the affected customers are based in the United States, the breach sits at the intersection of state-level breach notification laws rather than a single federal framework. Companies that experience a vendor breach affecting US residents typically face a patchwork of notification deadlines that vary by state, along with potential scrutiny from state attorneys general if the delay between discovery and disclosure is seen as excessive. The roughly three-and-a-half-week gap between ShipMonk’s August 10 notification to Trezor and Trezor’s first public warning on August 13 is short by industry standards, but the further delay before the full 67,000-person scope became public on September 4 is the kind of staggered disclosure timeline that has drawn regulatory criticism in other recent breach cases.
Security and privacy frameworks like the NIST Cybersecurity Framework increasingly treat third-party vendor risk management as a core requirement rather than a nice-to-have, pushing companies to conduct regular audits of what data their vendors retain and for how long. Whether Trezor had contractual limits on ShipMonk’s data retention, and whether those limits were followed, is likely to become a central question in how this incident is ultimately assessed.
How This Compares to Trezor’s Broader Security Reputation
Trezor has built its brand over more than a decade on the premise that its open-source firmware and offline key storage make it one of the most auditable hardware wallets on the market. That reputation is largely intact after this incident, precisely because the breach did not touch the device security model at all. But the episode is a reminder that a wallet maker’s total attack surface includes every company it does business with, not just the hardware and software it builds directly. Competitors in the space, including Ledger, Coldcard, and newer entrants like Keystone and OneKey, all face the identical structural risk any time they use outside vendors for shipping, marketing, customer support software, or payment processing.
Predictions: What Happens Next
- Expect the affected-customer count to grow again as ShipMonk’s forensic review continues; two upward revisions in under a month suggests the investigation is not yet closed.
- Phishing campaigns referencing Trezor orders, delivered by email, SMS, or physical mail in the style of the 2020 Ledger scams, are likely to appear within weeks rather than months.
- Trezor and other hardware wallet makers will face renewed pressure to publish, or at least summarize, their vendor data retention policies and audit schedules.
- State attorneys general in states with large numbers of affected residents may open inquiries into the disclosure timeline, mirroring scrutiny seen in other 2026 breach cases.
- Expect increased marketing from competing wallet makers emphasizing in-house fulfillment or minimal third-party data sharing as a security differentiator.
The Bigger Picture for Crypto Security in 2026
The Trezor-ShipMonk breach is unlikely to be remembered as a catastrophic hack in the way a drained exchange or a stolen seed phrase would be. No funds are known to have been taken as a direct result of this incident. But its real significance is what it says about where the weak points in crypto security have shifted. Wallet hardware itself has become extremely difficult to attack directly, which is exactly why attackers increasingly go around it, targeting the humans and vendors surrounding the device instead. A shipping label printed in 2020 turned out to be a liability in 2026, and that gap between when data is collected and when it becomes dangerous is only getting longer as more of daily commerce runs through third-party logistics platforms.
For readers tracking the broader wave of vendor and supply-chain breaches this year, Tech Insider’s ongoing coverage of related incidents, including session hijacking defenses and the security posture of hardware authentication tools like FIDO2 security keys, points to the same underlying trend: attackers are moving up and down the supply chain looking for the softest target, and increasingly, that target is not the flagship product at all.
Frequently Asked Questions
Did the Trezor breach expose my seed phrase or private keys?
No. Trezor has stated that seed phrases and private keys are generated and stored only on the physical hardware device and were never part of ShipMonk’s systems or exposed in this breach. The exposed data is limited to shipping and order information.
How many people are affected by the Trezor-ShipMonk breach?
Trezor first disclosed roughly 14,000 affected users in mid-August 2026. On September 4, 2026, it disclosed an additional 67,000 US customers were affected, bringing the combined total across both disclosures to more than 81,000 people.
What data was exposed in the breach?
According to Trezor and Bloomberg’s reporting, exposed data includes full names, email addresses, phone numbers, shipping addresses, and order details for customers who placed orders between November 2019 and August 2021.
Who is ShipMonk and why does it have my Trezor order data?
ShipMonk is a third-party order fulfillment and shipping logistics provider that Trezor used to process and ship customer orders. Companies commonly rely on outside fulfillment vendors like ShipMonk to handle warehousing and shipping rather than building that infrastructure themselves.
Is this similar to the Ledger data breach?
It shares the same basic structure as Ledger’s 2020 breach, in which a third-party database exposed customer contact and shipping information without compromising wallet security itself. Ledger’s breach was larger in scale, affecting roughly one million email addresses and around 270,000 physical addresses, and led to years of follow-on phishing campaigns against its customers.
What should I do if I bought a Trezor device between 2019 and 2021?
Treat any unsolicited email, text, call, or mailed package referencing your Trezor order as suspicious, never share your seed phrase with anyone, and verify any communication directly through Trezor’s official website. Consider reporting suspicious contact to the FTC or the FBI’s Internet Crime Complaint Center.
Will Trezor offer compensation or credit monitoring to affected customers?
Trezor’s public disclosures as of September 5, 2026, focus on notification and security guidance rather than announced compensation programs. Any compensation or monitoring offers would likely be communicated directly to affected customers by Trezor.
Does this affect Trezor’s newer hardware wallet models?
The breach is tied to order and shipping records from 2019 to 2021 rather than to any specific hardware model or firmware version. It does not indicate a security flaw in any current Trezor device.
