The breach did not compromise Trezor's own infrastructure, devices, firmware, or the Trezor Suite app. No private keys, seed phrases, PINs, passwords, or financial account details were accessed . However, the exposed data is considered especially dangerous in the crypto world because it creates a verified list of hardware wallet owners with their home addresses .

What data was exposed

The breach exposed different levels of data for two groups of customers:

• 11,742 customers — full names, email addresses, phone numbers, and shipping/home addresses were fully exposed .
• 1,947 customers — names, cities, and email addresses only (a partial data set) .
• Order numbers were also included in the exposure .

Why the scope was limited

The breach was confined to ShipMonk's systems. Trezor's own infrastructure — including its servers, devices, firmware, and the Trezor Suite application — was not compromised . The exposed data was limited to customers in seven countries: the United States, United Kingdom, Sweden, Colombia, Brazil, Italy, and Portugal .

Risks to affected customers

The primary risk is targeted phishing and social engineering attacks. Because the leaked data identifies individuals as confirmed Trezor hardware wallet owners and includes their home addresses and phone numbers, attackers can craft highly convincing scams — including physical mail, phone calls, SMS, and emails — pretending to be Trezor support or other trusted entities .

The dataset is considered especially dangerous because it provides a "verified" list of crypto holders at known addresses, making victims more likely to trust fraudulent communications .

Mitigation measures Trezor has announced

• Immediate investigation — Trezor says it is investigating alongside ShipMonk and has notified relevant authorities .
• Customer warnings — Trezor published a blog post and posted on X (formerly Twitter) advising all affected customers to remain vigilant against phishing attempts .
• Security advice — Trezor reminded customers that it will never ask for seed phrases, passwords, or PINs via email, phone, or text message, and urged users to only use official Trezor support channels .
• No mandatory actions — Trezor has not announced forced password resets, credit monitoring, or direct notifications beyond the public disclosure, though affected customers are advised to be cautious of unsolicited communications.

What affected customers should do

If you ordered a Trezor device between May 10 and August 8, 2026, and live in one of the seven affected countries, take these precautions:

• Be skeptical of unsolicited messages — Do not click links or download attachments in unexpected emails, texts, or social media messages claiming to be from Trezor.
• Verify support contacts — Only use official Trezor support channels listed on the company's website. Trezor will never ask for your seed phrase, PIN, or password.
• Watch for physical mail scams — Since home addresses were exposed, be alert for fraudulent letters or packages designed to look like they come from Trezor.
• Monitor for phishing attempts — Report any suspicious communications claiming to be from Trezor.

Trezor's devices and the crypto funds stored on them remain secure. The risk is entirely to personal information that could be used in social engineering attacks .

The breach did not compromise Trezor's own infrastructure, devices, firmware, or the Trezor Suite app. No private keys, seed phrases, PINs, passwords, or financial account details were accessed . However, the exposed data is considered especially dangerous in the crypto world because it creates a verified list of hardware wallet owners with their home addresses .

What data was exposed

The breach exposed different levels of data for two groups of customers:

• 11,742 customers — full names, email addresses, phone numbers, and shipping/home addresses were fully exposed .
• 1,947 customers — names, cities, and email addresses only (a partial data set) .
• Order numbers were also included in the exposure .

Why the scope was limited

The breach was confined to ShipMonk's systems. Trezor's own infrastructure — including its servers, devices, firmware, and the Trezor Suite application — was not compromised . The exposed data was limited to customers in seven countries: the United States, United Kingdom, Sweden, Colombia, Brazil, Italy, and Portugal .

Risks to affected customers

The primary risk is targeted phishing and social engineering attacks. Because the leaked data identifies individuals as confirmed Trezor hardware wallet owners and includes their home addresses and phone numbers, attackers can craft highly convincing scams — including physical mail, phone calls, SMS, and emails — pretending to be Trezor support or other trusted entities .

The dataset is considered especially dangerous because it provides a "verified" list of crypto holders at known addresses, making victims more likely to trust fraudulent communications .

Mitigation measures Trezor has announced

• Immediate investigation — Trezor says it is investigating alongside ShipMonk and has notified relevant authorities .
• Customer warnings — Trezor published a blog post and posted on X (formerly Twitter) advising all affected customers to remain vigilant against phishing attempts .
• Security advice — Trezor reminded customers that it will never ask for seed phrases, passwords, or PINs via email, phone, or text message, and urged users to only use official Trezor support channels .
• No mandatory actions — Trezor has not announced forced password resets, credit monitoring, or direct notifications beyond the public disclosure, though affected customers are advised to be cautious of unsolicited communications.

What affected customers should do

If you ordered a Trezor device between May 10 and August 8, 2026, and live in one of the seven affected countries, take these precautions:

• Be skeptical of unsolicited messages — Do not click links or download attachments in unexpected emails, texts, or social media messages claiming to be from Trezor.
• Verify support contacts — Only use official Trezor support channels listed on the company's website. Trezor will never ask for your seed phrase, PIN, or password.
• Watch for physical mail scams — Since home addresses were exposed, be alert for fraudulent letters or packages designed to look like they come from Trezor.
• Monitor for phishing attempts — Report any suspicious communications claiming to be from Trezor.

Trezor's devices and the crypto funds stored on them remain secure. The risk is entirely to personal information that could be used in social engineering attacks .