Trezor Logistics Partner Leaks Additional 67,000 U.S. Customer Data
Hardware wallet manufacturer Trezor reported that the data breach involving logistics partner ShipMonk is larger than previously disclosed: approximately 67,000 U.S. customers' names, emails, phone numbers, shipping addresses, and order numbers from orders placed between November 2019 and August 2021 have been fully exposed. The company stated that it has emailed affected individuals, and those who did not receive an email are not included.
When first disclosed on August 13, the breach affected orders from the U.S., U.K., Sweden, Colombia, Brazil, Italy, and Portugal within 90 days, with 11,742 individuals fully exposed and 1,947 partially exposed. ShipMonk experienced unauthorized access around August 8 and notified Trezor on the 10th. Trezor stated that contracts and data policies require the deletion of old orders, and it received written confirmations multiple times, but the other party's system did not actually delete the data. Trezor's own systems and devices were not compromised, and recovery phrases and private keys are not stored in the logistics database. The company will expedite the launch of anonymous shipping and warns against phishing emails, calls, letters, and personal safety risks, advising not to show wallet backups or input them on websites.
The addresses of hardware wallet buyers overlap with the "holding cold wallet" label, creating targeted phishing and home invasion risks. Amazon's channel was not included in this batch due to self-fulfillment. Trezor stated this is the first time since its founding in 2013 that phone numbers and addresses have been exposed.
The buyers are users who require physical isolation of keys, while the sellers are hardware manufacturers that outsource fulfillment to third-party logistics. The incident was driven by the logistics provider's supplementary reporting of historical data. Beneficiaries are those using anonymous shipping and self-built fulfillment, while those under pressure are left with a physical address book that can be located.
Source: Public Information
ABAB AI Insight
Cold wallets keep keys in chips while handing over names and addresses to couriers. The breach at ShipMonk affected the latter part. Trezor's 90-day deletion policy prevents a longer tail for new orders in 2026 but cannot stop the batch of "confirmed deletions" from 2019 to 2021. Written assurances cannot counter residual data on the other party's disks. The addition of 67,000 U.S. addresses gives attackers a list of cryptocurrency holders with order numbers, allowing phishing tactics to go directly from "your package" to "your recovery phrase."
The capital and operational path is that hardware has thin margins, and global fulfillment must be outsourced; security budgets are spent on secure components, not on building U.S. warehouses. Anonymous shipping is a post-facto patch: using email aliases and transfer lockers to sever the link between addresses and devices. The Amazon channel was spared, indicating that platform fulfillment can sometimes be more isolated than brand-selected third-party warehouses.
Comparable incidents include Ledger's 2020 e-commerce and marketing database leak leading to in-person intimidation, as well as any industry that ships high-value items to real-name addresses. The industry is at a supply chain stage of "device security, identity exposure."
Structurally, it belongs to a phase where technical replacement is not yet complete: chips have replaced hot wallets and hot keys but have not replaced real-name logistics. The mechanism is that attackers choose the weakest link in defense, not the largest market cap; if deletion commitments are not auditable, historical customers are always a potential liability.
ABAB News · Cognitive Law
Keys are in chips, addresses are on shipping labels
Written confirmation of deletion does not mean there is nothing on the disk
The real addresses of high-value items are, in themselves, an attack surface