Trezor, a cryptocurrency hardware wallet manufacturer founded in 2013 and backed by Prague-based SatoshiLabs, has disclosed that a data breach first announced in August is much larger than initially feared. In a follow-up update published on September 4, 2026, Trezor revealed that an additional 67,000 customers in the United States were affected by the security incident at one of its third-party shipping providers, ShipMonk. Those customers placed orders between November 2019 and August 2021, and their personal details are now considered compromised.
The latest announcement brings the total number of impacted users to approximately 80,689. This marks the first significant data breach in Trezor’s history since it introduced its first hardware wallet more than a decade ago. The company warned that affected users could face highly targeted phishing campaigns, fraudulent phone calls, malicious text messages, and even physical security risks because attackers now have access to names, home addresses, phone numbers, email addresses, and order information.
Understanding the timeline of the Trezor breach
The unfolding incident began when ShipMonk, a third-party logistics and order fulfillment company, informed Trezor on August 10 that its systems had been breached. At that time, Trezor reported that roughly 13,689 customers were affected. However, on September 2, ShipMonk provided updated intelligence indicating that the initial breach was considerably more extensive than first believed. Two days later, Trezor confirmed the additional wave of 67,000 affected users.
According to the company, the leaked data for this newly identified group includes full exposure of names, email addresses, telephone numbers, shipping addresses, and order numbers. Trezor included this detail in a cautionary note to its user base, underscoring that the information is sufficient for malicious actors to craft convincing personalized scams.
Why the extra data is so dangerous
Unlike a loss of payment card details, the exposure of physical addresses together with phone numbers and email addresses creates a multifaceted threat landscape. Scammers can send SMS messages that appear to originate from Trezor’s support team, call victims while referencing recent orders, or send physical mail designed to trick recipients into installing malicious firmware or visiting phishing websites. Because order numbers were also leaked, attackers can include legitimate-looking order references to gain trust.
Trezor has long advised users to never share their recovery seed phrase. In past warnings, the company emphasized that no legitimate support representative would ever ask for those words. With access to personal order details, phishing attempts can appear even more credible, forcing affected customers to stay extra alert.
Trezor’s relationship with SatoshiLabs
Trezor is the flagship product line of SatoshiLabs, a Czech-based company that has been a major contributor to the Bitcoin and cryptocurrency ecosystem. SatoshiLabs first introduced the Trezor, which translates to 'safe' or 'vault' in Czech, in January 2014 after a successful crowdfunding campaign. The device’s primary goal was to keep private keys offline while allowing users to transact with cryptocurrency safely.
Over the years, Trezor expanded its product lineup with the Model One, Model T, and the more recently launched Safe series. The hardware wallets have been praised for their transparent firmware development and compatibility with multiple cryptocurrency wallets. Despite its reputation for security, Trezor acknowledges that supply chain partners can introduce vulnerabilities that fall outside the hardware wallet’s core security architecture.
ShipMonk and the data retention failure
Trezor expressed disappointment with ShipMonk’s handling of customer data. The company revealed that its agreement with ShipMonk specifically required all customer shipping details to be erased after 90 days. ShipMonk had also provided written assurances that data destruction had been completed. However, the breach exposed records that spanned from November 2019 to August 2021, far beyond the permitted retention window.
This violation of data protection expectations is central to the incident. Had ShipMonk complied with the contractual data retention policy, it would have had little or no data on file to expose. Trezor criticized this lapse and emphasized that it is reviewing both its fulfillment processes and the broader security of its third-party suppliers.
Trezor moves toward anonymous delivery
In response to the breach, Trezor announced that it is actively working to ship its products without revealing personal information in future transactions. The company noted that anonymous delivery would allow customers to place orders while protecting their identity and physical address, significantly reducing the consequences of a future logistics provider breach.
'We take this matter very seriously and are working to ship anonymous delivery as soon as possible, so you can protect your personal information when placing an order,' a Trezor representative said. The company did not provide an exact release date for the anonymous shipping option, but it framed the initiative as an essential step toward reducing the attack surface in a hardware wallet supply chain.
A challenging year for hardware wallet manufacturers
Trezor is not the only hardware wallet vendor to face security issues in 2026. Ledger, a major competitor based in France, has encountered multiple security incidents over the year, including a supply-chain customer data breach that affected its payment processor Global-e. Ledger also faced critical vulnerabilities in third-party application code for its Ethereum and Zilliqa apps, forcing the company to release emergency firmware updates and temporary suspensions of certain services.
Coldcard, a Bitcoin-focused hardware wallet, suffered what many describe as the most severe technical exploit of the year. A long-standing flaw in its seed generator permitted attackers to drain more than $116 million in Bitcoin, representing a catastrophic failure in one of the most security-conscious segments of the crypto hardware market.
The recurring incidents across Trezor, Ledger, and Coldcard highlight the difference between device-level security and supply-chain security. Even when a hardware wallet itself is technically robust, attackers often target logistical infrastructure, customer service workflows, or software dependencies as alternative paths to compromise users.
How affected users can protect themselves
For those who may have been affected by the Trezor breach, immediate steps are important. Since the exposed information includes contact details and order history, users should be wary of any unsolicited communications that claim to be from Trezor, ShipMonk, SatoshiLabs, or related partners. Legitimate cryptocurrency companies rarely initiate unsolicited phone calls or ask customers to provide sensitive information.
Anyone who receives a suspicious email or message should verify the sender’s email address and avoid clicking links. Trezor support, like most cybersecurity-conscious crypto firms, would never ask for recovery seed phrases or private keys. Any request for these credentials, even if it references a real past order, is a red flag.
In addition to practicing caution with phishing attempts, users can further protect themselves by changing associated passwords and enabling two-factor authentication on their email accounts. If a mobile phone number is exposed, SIM swapping is a potential second-stage attack, meaning users should contact their carrier about additional SIM protections. Concerned customers can also monitor their physical mailbox for unexpected packages or forged correspondence.
While Trezor works to implement anonymous deliveries and reviews its third-party risk management, users are advised to remain alert. The breach represents one of the rare cases where the physical and digital realms collide, since an exposed home address can enable social engineering beyond the inbox.
The company has not yet announced whether affected customers will receive individual notifications for the newly disclosed 67,000 accounts, and it remains unclear what compensation or remediation steps, such as credit monitoring or identity protection services, might be offered. Trezor’s priority appears to be damage control and preventing such an incident from happening again.
Source:Finbold News