Home addresses, phone numbers, and full names of nearly 14,000 Trezor hardware wallet buyers have just been exposed. ShipMonk, Trezor’s shipping service partner, suffered unauthorized access to its system, exposing customer data from seven countries, including the United States, United Kingdom, Sweden, Colombia, Brazil, Italy, and Portugal.
Out of the total victims, 11,742 customers lost complete privacy as their names, emails, phone numbers, and shipping addresses were leaked. Meanwhile, 1,947 other customers were affected to a lesser degree, with exposed data limited to their names, cities, and emails. Trezor has already sent email warnings to all parties affected by the incident. For customers who did not receive a notification, their data is confirmed to be safe. Buyers who transacted via Amazon were also spared from this breach because they use a different logistics partner.
Not the Assets, But the Owners
Trezor emphasized that their internal systems were not breached. The hardware wallets and the crypto assets inside remain intact. However, the risk of this leak has instead moved to the physical world. Customers whose data was stolen are now prime targets for phishing campaigns, whether via email, phone calls, or physical mail sent directly to their home addresses.
This physical extortion threat cannot be taken lightly. During the first half of 2026 alone, losses from physical attacks on crypto owners surpassed $124 million. The leak of buyers’ precise home locations increases the risk of targeted crime, although Trezor states it has found no evidence that the stolen data has been published or sold on the dark web.
Weak Points in the Supply Chain
The ShipMonk incident is another mark on Trezor’s track record. This is the first breach in the company’s 13-year history to expose users’ shipping addresses and phone numbers. Previously, they experienced data leaks twice through third-party customer service portals - in January 2024 affecting 66,000 people and April 2022 with 106,856 victims, but neither involved home addresses.
Third-party vendor security issues continue to be a recurring vulnerability in the hardware wallet industry. Their main competitor, Ledger, suffered a similar fate when its e-commerce partner Global-e was hacked in January 2026, following a massive breach in 2020 that exposed 300,000 users. Indeed, the trend of data breaches in the crypto sector has risen 17% from last year, with an average of 2,090 attacks occurring weekly worldwide.
Buying a steel vault coated in the strongest cryptography means nothing if the courier delivering it leaves the buyers’ address list in a public place. The digital fortress may remain unbreached, but hackers are now searching for vulnerabilities at the weakest point: your own front door.
As reported by CoinDesk.
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
