Trezor, the cryptocurrency hardware wallet maker, has confirmed a data breach at ShipMonk, a third-party shipping provider it uses. The breach exposed personal information belonging to 13,689 recent customers, including names, contact details, and shipping addresses.
What Was Exposed
The compromised data includes names and contact information that could be used for targeted phishing attacks. Shipping addresses are also part of the leak, which creates a potential physical-security risk by tying named customers to their home or business locations.
Trezor said the breach affected only recent customers, not its entire user base. The company did not specify how long the exposure lasted or when it was discovered.
Why Shipping Addresses Matter
For a hardware wallet company, the stakes are higher than a typical retail breach. Knowing who owns a Trezor device and where they live could help attackers plan physical theft or more convincing social engineering. Phishing emails that reference a real order and a real address are far harder to spot than generic scams.
Trezor has not said whether any customers have reported fraud or theft linked to the breach. The company is advising affected users to be wary of unsolicited messages and to verify any communication that claims to be from Trezor.
What Trezor Is Doing
The company said it is working with ShipMonk to investigate the incident and has notified affected customers directly. Trezor also pointed users to its official support channels for guidance on how to spot phishing attempts.
It's unclear whether ShipMonk has disclosed how the breach happened or how many other companies may be affected. Trezor has not said if it will offer credit monitoring or other identity-protection services to impacted customers.
For now, the immediate risk is phishing. Anyone who bought a Trezor device recently should treat unsolicited emails or calls with suspicion, especially those that ask for passwords, recovery seeds, or payment details.
The company has not announced a timeline for when its investigation will conclude, nor has it said whether it will change shipping providers as a result.
