A breach at ShipMonk compromised personal data for nearly 14,000 Trezor hardware wallet customers, raising concerns about targeted phishing and physical attacks as crypto-related security incidents accelerate in 2026.
Nearly 14,000 customers who purchased Trezor hardware wallets are now at heightened risk of phishing and physical threats after a data breach at ShipMonk, the company's third-party fulfillment provider. Trezor revealed that an unauthorized party accessed customer order records stored by ShipMonk, affecting buyers in the United States, United Kingdom, Sweden, Colombia, Brazil, Italy, and Portugal who placed orders between May 10 and August 8, 2026. ShipMonk notified Trezor of the incident on August 10, and Trezor publicly disclosed the breach three days later.
Scope of the Exposure
The breach divided affected customers into two groups. For 11,742 individuals, attackers obtained full names, email addresses, phone numbers, and home addresses. Another 1,947 customers had their names, cities, and email addresses exposed. Trezor stated that its own internal systems, hardware wallets, private keys, and wallet backups were not compromised. The company's policy requiring fulfillment partners to delete or anonymize order data within 90 days of delivery limited the breach to recent orders, as older records had already been purged. Only customers who received a direct notification from Trezor were impacted.
Phishing and Physical Security Risks
Trezor warned that the combination of names, addresses, and phone numbers could enable attackers to craft convincing phishing attempts, impersonating Trezor, banks, or crypto exchanges to extract sensitive credentials such as seed phrases. The risk extends beyond digital threats: with home addresses exposed, physical attacks on crypto holders have become more frequent. Security firm CertiK reported 52 verified physical attacks targeting crypto users in the first half of 2026, up from 39 in the same period last year. Chainalysis estimated that over $30 million was stolen through violent incidents in the first six months of 2026, putting the year on track to surpass the $58 million lost in all of 2025. One recent case involved a French couple who suffered three home invasions after moving into a property previously owned by crypto millionaires whose address had leaked online, illustrating how supply chain data breaches can have long-term consequences.
Industry Response and New Delivery Options
Trezor described this as the first incident in its 13-year history to expose both customer phone numbers and shipping addresses. In response, the company is accelerating the rollout of an Anonymous Delivery service, which will use parcel lockers, neutral packaging, and automatic deletion of shipping identifiers after delivery. The service is set to launch in the EU in September 2026, with a U.S. rollout planned by year-end. The breach comes amid broader concerns about hardware wallet security, as losses from the Coldcard exploit neared $130 million and some users moved funds to multi-signature wallets after observing the fallout. Earlier this year, Ledger disclosed a separate breach at its e-commerce provider Global-e, exposing customer names and contact details. Ledger's 2020 breach, which affected about 272,000 customers, demonstrated the persistence of such risks, with some victims still receiving fraudulent physical mail years later.
For context, crypto security leaders have warned that new attack vectors-such as those potentially enabled by quantum computing-could resemble routine wallet losses, making detection and prevention even more challenging. For a deeper look at how emerging threats could impact wallet security, see EgonCoin's analysis on the potential for undetected quantum attacks on crypto wallets.
According to Trezor, the company's internal systems and wallet infrastructure were not breached, and no private keys or wallet backups were accessed. The company emphasized that only customers who received a direct notification were affected, and that the breach was contained to orders placed within the previous three months due to its data retention policy. CertiK's data shows a clear upward trend in physical attacks on crypto holders, while Chainalysis' estimates highlight the growing financial impact of such incidents. These figures underscore the importance of robust data protection and user vigilance as the crypto hardware wallet market continues to expand.
Hardware wallets are designed to keep private keys offline, reducing the risk of remote hacking. However, when personal information such as names, addresses, and phone numbers are exposed, attackers can bypass technical defenses through social engineering or physical threats. This breach highlights the need for users to remain cautious about unexpected communications and to consider privacy-focused delivery options when purchasing crypto security devices. As the industry adapts to evolving threats, both companies and users must weigh the trade-offs between convenience, privacy, and security in managing digital assets.
