Crypto hardware wallet Trezor revealed today that the personal details of 13,689 of its customers have been leaked.
The breach at Trezor’s mailing partner, ShipMonk, impacted users across the UK, US, Sweden, Colombia, Brazil, Italy, and Portugal, who ordered a Trezor product between May 10 and August 8, 2026.
Nearly 12,000 customers had their full name, physical address, phone number, and email address leaked, while almost 2,000 saw their name, city, and email address leaked.
Trezor says private keys are safe
Trezor claims someone gained “unauthorized access” to ShipMonk’s systems, and that Trezor infrastructure, such as its devices and private keys, is unaffected.
It warned that leaked users are now at risk of phishing scams via phone, email, or post, and stressed that “Nobody from Trezor ever asks for a wallet backup.”
Read more: Search engines fix Claude leak but Perplexity users’ files still online
The wallet firm says only users who received a warning email from Trezor today are impacted by the leak.
Trezor says it’s yet to decide on ShipMonk partnership
Trezor told Protos that it was informed of ShipMonk’s breach on August 10.
It said it’s still gathering information on the incident and that, only when it has the full picture, will it “decide on the future” of its partnership with ShipMonk.
Trezor emphasised how its 90-day data policy helped mitigate the leak with its ability to “delete or anonymize order data 90 days after delivery.”
It claims that it is also pushing an “anonymous delivery” this year, and noted that it will share more details of the ShipMonk breach once a full report is ready.
Wallet data leaks lead to targeted scams
Crypto wallet maker Ledger suffered similar customer data leaks back in 2020 and 2026.
Following the 2020 breach, hackers sent fake Ledger devices that were designed to upload malware into a user’s computer.
Scammers used this same leaked data five years later to send fake Ledger letters that attempted to trick recipients into handing over their recovery phrases.
Trezor customers have previously been targeted with phishing campaigns that used phoney stories of quantum vulnerability disclousres to trick victims.
Read more: Why did I receive a Trezor phishing email from Substack?
It’s also believed that criminals use this sort of leaked data to physically target crypto users.
This was the case last week when lawyers in France claimed the leaked address of one retired crypto millionaire, who had since moved out of his former property, led to the attacks against the new owners.
Got a tip? Send us an email securely via Protos Leaks. For more informed news and investigations, follow us on X, Bluesky, and Google News, or subscribe to our YouTube channel.
