Trezor Breach Exposes Up to 80,000 Customer Records via Shipping Partner ShipMonk

A shipping partner retained Trezor customer data for years after certifying it had been deleted, exposing between 67,000 and 80,000 customer records in a breach the hardware wallet maker says it only recently discovered.

The exposed data covers orders placed as far back as 2019. Trezor says it received written confirmation from logistics provider ShipMonk that the records had been purged, making the retention a direct violation of that assurance. The company has since disclosed the incident publicly, framing it as a vendor failure rather than a compromise of its core product.

That distinction matters, but only up to a point. Trezor's cryptographic architecture, the private key management and signing logic that makes hardware wallets valuable, was not touched. No wallet funds are at direct risk from this breach. What was exposed is customer metadata: names, shipping addresses, and order details. For ordinary consumers, that might be a minor nuisance. For cryptocurrency hardware wallet buyers, it is a more serious problem. Owning a hardware wallet is itself a signal of meaningful crypto holdings, and shipping records confirm a physical delivery address. That combination is precisely the profile that social engineering attackers and physical theft operations target. Phishing campaigns, SIM-swap attempts, and even home visits have followed similar data exposures in the past.

The precedent here is uncomfortable. In 2020, Ledger, Trezor's primary competitor, suffered a data leak that exposed roughly 1 million customer records, also through a third-party marketing and e-commerce partner. That breach generated years of phishing emails, SMS scams, and at least several publicly reported physical threats against affected users. The Trezor incident is smaller in scale but structurally identical: a hardware security company with sound cryptographic practices failed at the operational layer, specifically in vendor oversight. The fact that ShipMonk apparently held onto data for at least five years after certifying deletion suggests the failure was not a one-time lapse but a systemic gap in how Trezor audited third-party compliance.

Trezor has not detailed what remediation steps it is taking with ShipMonk, nor has it specified whether it is pursuing legal action for the certification breach. The company has not publicly disclosed whether affected customers will receive direct notification, which is a relevant question given data protection obligations in the European Union under GDPR and in several U.S. states under their respective consumer privacy statutes. Trezor is incorporated in the Czech Republic and sells globally, meaning multiple regulatory frameworks could apply.

For the roughly 67,000 to 80,000 customers whose records were retained without authorization, the immediate risk is phishing and social engineering rather than direct wallet compromise. Security practitioners recommend that affected users treat any inbound communication referencing their Trezor purchase with heightened skepticism, enable two-factor authentication on any accounts linked to the email address used for that order, and be alert to physical mail or calls referencing their address. The Trezor device itself does not need to be replaced or reconfigured.

The broader takeaway for the hardware wallet industry is structural. Companies like Trezor invest heavily in tamper-resistant chips, secure element architecture, and open-source firmware audits. Those investments are meaningful. But a supply chain that touches logistics providers, fulfillment centers, and payment processors creates a data surface that cryptographic engineering alone cannot protect. Vendor contracts that include deletion certifications are only as strong as the audit processes that verify them. In this case, verification apparently did not happen, and customers are now managing the consequences of a data retention decision made by a third party they never chose and likely never knew existed.