ShipMonk told Trezor on Monday, August 10, that someone had reached its systems. By Wednesday, the number was 13,689. By Friday, it was 80,000. The final tally keeps moving.
The attack vector wasn't a zero-day in Trezor's firmware. It wasn't a compromised seed phrase, a malicious supply chain implant, or a broken random number generator. It was a SQL injection vulnerability in Metabase, the analytics dashboard running inside ShipMonk — a third-party logistics company Trezor pays to pack and mail boxes. [[9]] Someone exploited that hole, walked out with customer order data, and then the extortion emails started. [[9]]
Your private keys are fine. Your Trezor device is fine. Your wallet never left your hands. None of that matters. Because the attackers didn't want your keys. They wanted your name, your home address, your phone number — and the knowledge that you own a hardware wallet. [[13]]
This is the second hardware wallet supply chain bleed in under a year. Ledger's payment processor leaked customer order data in January 2026, and within days attackers fired off phishing emails announcing a fake Ledger-Trezor merger, personalized with real order details. [[14]] The pattern is repeating. And it's getting worse.
The breach that keeps expanding
The ShipMonk incident first surfaced when the logistics provider reported unauthorized access on August 6. Initial disclosure covered roughly 13,689 customers across the US, UK, Sweden, Colombia, Brazil, Italy, and Portugal who ordered between May 10 and August 8, 2026. [[2]][[3]] Trezor's own 90-day data retention policy was initially cited as the reason the blast radius stayed contained.
Then the floor opened up. Two days before Trezor's September 4 update, ShipMonk came back with new findings: another 67,000 US customers, whose orders were placed between November 2019 and August 2021, were still sitting in the system. [[4]][[5]][[6]]
Records that should have been purged years ago. Records that Trezor says it repeatedly asked ShipMonk to delete. Records that ShipMonk gave written assurances were gone. [[4]][[6]]
They weren't. Trezor's own words on X: "Despite confirmed receipt, the data was not deleted in their systems. We are very disappointed." [[4]]
So here's the uncomfortable math. This isn't a hacking story about clever exploit chains. It's a story about a logistics vendor that held years-old customer data against a written agreement, ran it on an analytics platform with a known vulnerability class, and called it done. ShipMonk holds SOC 2 Type II certification — an audited security standard. SOC 2. Breached anyway. [[14]]
That certification was worth exactly what the paper it was printed on cost.
The threat model nobody audited
Let me be precise about what actually leaked and why it matters more than a stolen database of email addresses. The exposed fields for the new batch: names, email addresses, phone numbers, shipping addresses, and order numbers. [[6]]
That's PII in the most complete, weaponizable form possible for a crypto user. Someone now knows your name, where you live, how to reach you — and that a hardware wallet was delivered to that door. This is a verified list of crypto asset holders with physical coordinates. [[14]]
This is not the same threat as a leaked private key. It's worse in a specific way: it converts a digital asset problem into a physical safety problem.
Based on my audit experience across hardware wallet supply chains, the security model of a cold wallet stops at the edge of the device. Trezor's architecture is solid — keys generated internally, never leaving the silicon. But the buyer's exposure doesn't stop at that edge. The moment you order a hardware wallet through an ordinary fulfillment chain, you print a paper trail that ties your real-world identity to your crypto ownership. And that trail is now in the hands of whoever bought this data on the dark web.
Physical attacks on crypto holders are accelerating. CertiK verified 52 physical incidents in the first half of 2026, up from 39 in the same period in 2025. Home invasions now overtake kidnapping as the most common method. Chainalysis pegged the total stolen through violence at over $30 million in that window alone — putting 2026 on pace to blow past the $58 million taken across all of 2025. [[10]]
Now overlay that trend on an 80,000-row database of names and home addresses linked to hardware wallet purchases. You don't need to be a security researcher to connect those dots.
The SIM swap angle nobody's talking about
The obvious play is phishing. Scammers will impersonate Trezor support, banks, and exchanges using the leaked personal details. Extortion mail quoting a real home address follows every leak of this shape — the accurate personal data proves nothing except that your information was in the dump. [[17]]
But the higher-confidence attack vector, the one the mainstream coverage keeps missing, is SIM swapping. The leaked phone numbers are a direct entry point. An attacker who knows your name, your carrier, and your address has a significantly better shot at social-engineering a SIM swap to seize your 2FA. And once they own your phone number, they don't come for your Trezor — they come for the centralized exchange account linked to that wallet, the one protected by SMS-based two-factor authentication.
That's the real escalation. The hardware wallet itself is a fortress. The ecosystem around it is a trading post.
Trezor's guidance is correct: never enter your recovery seed anywhere, no legitimate support process asks for it, type trezor.io yourself rather than clicking email links. [[17]] But that guidance only protects the device layer. It does nothing against the compounding risk of your phone number, your address, and your purchase history all sitting in one attacker's spreadsheet.
The contrarian read: this is not a Trezor failure
Here's the angle the market narrative gets wrong. This is not evidence that hardware wallets are insecure. It's evidence that the supply chain around them has a systemic fragility that no amount of cryptographic excellence can patch.
The cold wallet industry's core promise is that your keys never leave your device. That promise held. Trezor's own systems were never compromised. The wallets are secure. [[12]] What failed is the adjacent layer — logistics, data retention contracts, vendor security posture. And that layer is the one every hardware wallet manufacturer depends on.
Ledger learned this in 2020 when over a million email addresses circulated. Trezor learned it in 2022 with a 106,856-customer exposure, again in 2024 with 66,000 names and emails from a compromised support portal, and now again in 2026. [[20]] The same attack pattern, through different vendors, on a repeating cycle. The common denominator isn't the hardware. It's the third-party data processing chain around it.
This is the unglamorous reality of compliance-grade security: GDPR's data minimization principle — the very rule that was supposed to prevent this — only works if vendors actually honor deletion requests. ShipMonk's failure to delete is a data lifecycle management failure, not a cryptography failure. And it's exactly the kind of failure that regulatory bodies in the EU and California will want to interrogate.
Trezor's initial response understated the scale — 13,689 first, then 80,000+. That gap reflects an internal data monitoring lag that warrants scrutiny. But the company's crisis communication has been genuinely transparent: direct emails to all affected users, public acknowledgment of ShipMonk's deception, and a commitment to an "Anonymous Delivery" mode with locker pickup, neutral packaging, and automatic deletion of shipping identifiers after delivery. [[11]][[15]][[19]] That's a structural response, not a PR band-aid.
What regulators won't let slide
As a data controller, Trezor wears the liability for its processors. EU GDPR exposure peaks at €20 million or 4% of global annual revenue — whichever is higher. California's CCPA imposes its own notification and enforcement regime. The core failure here — a vendor that received written deletion assurances and didn't follow through — is precisely the kind of fact pattern that triggers EU data protection authority investigations and class action filings.
And there's a deeper regulatory question nobody is asking: the disclosure that ShipMonk retained records from 2019–2021 means Trezor's own 90-day data retention policy was either never enforced downstream or was never actually communicated as binding to its logistics partner. Either way, that's an audit finding, not a talking point.
The cross-border data flow angle adds more surface area. Trezor (EU entity) transmitting customer data to ShipMonk (US entity) implicates GDPR Chapter V transfer requirements. If the transfer mechanism wasn't airtight, that's a separate violation layered on top of the breach itself.
The industry is about to get a reckoning
This event lands at a specific moment in the hardware wallet lifecycle. Physical attacks are up 33% year over year. [[10]] The threat model has shifted from "who can break my cryptography" to "who knows my address." And the market's risk premium on that distinction is about to reprice.
Competitors like Tangem and KeepKey are already framing themselves as alternatives for privacy-conscious users. [[8]] Expect the marketing to get aggressive. Expect ISO 27001-style certifications to become table stakes rather than differentiators. And expect a serious conversation about whether hardware wallet manufacturers should vertically integrate logistics or move to decentralized fulfillment models entirely.
Trezor's Anonymous Delivery rollout — dedicated checkout, locker pickup, neutral packaging, generic sender details — is the right instinct, but it's a mitigation, not a fix. [[11]] The underlying problem is structural: every hardware wallet company routes physical delivery through third parties who hold purchase data, and every one of those third parties is a potential single point of failure.
The takeaway
Your keys are safe. Your doorbell is not. The next time you buy a hardware wallet, ask one question before you hit checkout: who else gets to know your address, and what are they contractually required to do with it after the package arrives?
If the answer is "I'm not sure," you're already carrying the risk.
Trezor will survive this. Hardware wallets will remain the standard for self-custody. But the industry just got a hard lesson in the difference between making the lock unbreakable and printing the door number on the list of who owns one. [[18]]
Governance isn't a meeting. It's a data deletion contract I didn't read until it cost 80,000 people their physical privacy.