Was my home address leaked in the Trezor shipping data breach?

On 13 August 2026, Trezor published an official notice and emailed customers from [email withheld]: its shipping partner ShipMonk had told the company on 10 August that someone had gained unauthorized access to systems holding customer order data.

The incident covered orders sent to the United States, the United Kingdom, Sweden, Colombia, Brazil, Italy and Portugal. Trezor keeps shipping data for 90 days, so most records were from about 10 May to 8 August 2026. About 13,689 customers were affected. Of those, 11,742 had the full set taken — full names, email addresses, phone numbers, shipping or home addresses, and order numbers. Another 1,947 had only names, cities and emails; Trezor said those records “may include older orders” and was still confirming dates with ShipMonk. Trezor’s own systems, devices, private keys and wallet backups were not compromised.

The keys are fine. That is not the problem.

Almost every report of this incident opened the same way: no wallets were broken into, no private keys were taken, your coins are not sitting in someone else’s account because of this leak. That is true. It is also the least useful part of the story if a Trezor was shipped to your home.

What the attacker actually holds is a list of named people, at known home addresses, documented as owning a hardware wallet. A hardware wallet is not a neutral purchase. It is a strong signal that someone keeps cryptocurrency. Add a phone number and an email, and that is enough to write a message that sounds like Trezor, to call you by name, or to decide which door is worth paying attention to. The coverage treated “keys safe” as reassurance. For a normal person, the live issue is the opposite: someone now has a short, accurate list of who bought one of these devices and where it was sent.

This is not a “your money is already gone” event. It is a “your name now sits next to your address and the fact that you own a hardware wallet” event. Those are different problems, and the second one does not end when the first is ruled out. There is no public list we can check to tell you whether your order was in this set. If you had a Trezor shipped to one of those countries in that window, treat the notice as if it applies until you have a reason not to. Trezor said it emailed the people it believes were affected.

What to actually expect

• Emails or texts that mention this exact incident — a “replacement device,” a “security review,” or a link to “check if you were affected.” Trezor already sent the real notice from [email withheld]. It will not ask for your recovery words, PIN, or for you to plug your device into a website.
• Calls or messages that use your real name, city, phone number or order number. Those fields were in the file. A stranger does not have to guess them.
• A higher chance of targeted physical attention if you were in the group of 11,742 with a full address — someone watching for packages, or treating that house as a place that might hold a device. That is not the common outcome. It is the reason a list like this has value.
• The same records showing up again later, sold or copied, with no second email from Trezor. Once a shipping file is taken, it is usually reused quietly.

What you can and cannot fix

If your name, email, phone number or home address was in this file, it is out. It cannot be recalled. Trezor cannot delete it from whoever took it. ShipMonk cannot either. Anyone offering to wipe you from the breach is selling something they cannot do.

What still helps, in order:

• Treat any unexpected Trezor contact as fake unless you started it. Do not click links in mail about this leak. Do not read out recovery words, a PIN, or a “verification code” to anyone who reaches you. If you need the company, type the official site yourself.
• Be slower than usual with the inbox and phone number that were on the order. Password-reset mail, “your package couldn’t be delivered,” and “confirm your order” texts are the easy next step with this kind of file. That traffic will look personal, because the sender already has the personal parts.
• Shrink the rest of your public footprint. A bare shipping record becomes dangerous when it is joined to people-search listings that already publish relatives, extra phone numbers, employers and previous addresses. Those listings, unlike the leaked data, can actually be removed. Taking them down is the one step that makes the stolen file less useful to someone trying to build a full picture of you.
• Assume a stranger now has a reason to care what arrives at that address. The leak does not reveal a wallet backup. It does show that a Trezor was sent there. If you keep a written copy of your recovery words in the same place, moving that paper is one of the few physical steps that still means something.