Trezor Shipping Data Breach — 13,689 Hardware Wallet Buyers, Home Addresses Included

On 13 August 2026 Trezor confirmed that ShipMonk, one of its shipping providers, had been breached. An attacker reached ShipMonk’s systems through a vulnerability in Metabase, a third-party analytics platform, and accessed customer order data.

13,689 Trezor customers are affected. For 11,742 of them the exposure is full: name, email address, phone number and home shipping address. For a further 1,947 it is partial — name, city and email. The window is orders received between 10 May and 8 August 2026, in the United States, United Kingdom, Sweden, Colombia, Brazil, Italy and Portugal.

No keys were taken. That is not the reassurance it sounds like.

Trezor is clear, and correct, that no private keys were touched and no device was compromised. Your coins did not move and your seed phrase is not in this data.

But read what the attacker actually has. Not a database of anonymous shoppers — a list of named people, at known home addresses, who are documented as having bought a hardware wallet in the last three months. A hardware wallet is what someone buys when they hold enough to be worth protecting. The data set is, functionally, a shortlist.

That is a different category of problem from a leaked password, and it is why the coverage framing — “no funds at risk” — undersells it. The risk here is not cryptographic. It is phishing that knows your real name and address, and in the worst case it is physical.

What to actually expect

• Phishing that is far more convincing than usual. Anyone working this list can open with your real name, the address they shipped to, and the fact you own a Trezor. Treat any message referencing your order as hostile by default.
• Fake “breach response” contact. The predictable follow-up to a breach like this is a message claiming to be Trezor support offering to secure your wallet. Trezor will never ask for your seed phrase, and neither will anyone legitimate. There is no exception to this. Nobody who needs your recovery words is helping you.
• Address-based targeting. This is the part nobody writes up, because it is uncomfortable. A name and a home address, tied to evidence of crypto ownership, is the input to a physical threat. It is rare. It is not hypothetical, and people in this position have been robbed.

What you can and cannot fix

You cannot un-leak an address. Anyone telling you otherwise is selling something, and we are not going to pretend this is recoverable when it is not.

What you can change is how much else is findable next to it. The leaked record on its own is a name and an address. It becomes far more dangerous when someone joins it to the rest of your footprint — the people-search listings that tie that address to your relatives, your phone number, your employer, your age, and every previous address you have lived at. Those listings are not from this breach. They were already public, and unlike the ShipMonk data they can be removed.

Concretely, and in the order worth doing them:

• Assume the address is permanently out. Plan around that rather than hoping it decays.
• Cut the joins. Removing your people-search and data-broker listings is what stops a leaked address from becoming a full profile. This is the part that is actually actionable.
• Never discuss holdings under your real name, and treat any unsolicited approach that already knows your name and address as an attack.
• Deliver to somewhere that is not your home. For future hardware purchases, a parcel locker or a work address breaks this link before it is made.

None of that undoes the leak. It reduces what the leak connects to, which is the only lever anyone actually has here.