Trezor Customers Caught in a Second Wave of ShipMonk Data Leak
The crypto hardware wallet maker says 67,000 more U.S. buyers had their names, addresses and phone numbers exposed through its old shipping partner. The wallets themselves are unaffected.
Key points
- Trezor said on Friday that 67,000 more U.S. Customers had personal details exposed in a breach at its former shipping partner ShipMonk.
- The leaked data covers orders placed between November 2019 and August 2021, and includes names, email addresses, phone numbers and shipping addresses.
- No passwords, payment details or recovery seeds were exposed, Trezor said.
- Trezor had previously been told the data was deleted, which turned out to be wrong.
- Affected customers should expect a rise in targeted phishing attempts and physical mail scams.
Trezor, the Czech company that makes small USB-style devices for storing cryptocurrency offline, has told another 67,000 of its U.S. Customers that their personal details were exposed in a breach at ShipMonk, the logistics firm it once used to post orders.
The disclosure, first reported by The Hacker News, is an unwelcome sequel. Trezor had already warned a smaller group of customers about the same ShipMonk incident. The exposed dataset turned out to be much larger, and assurances the data had been wiped were incorrect.
What was actually leaked?
Contact and shipping information, nothing that touches the wallets themselves. Names, email addresses, phone numbers and shipping addresses were all in scope, along with order numbers. The orders date from November 2019 through August 2021.
No passwords were caught in the breach. No payment card numbers, either. Critically for a crypto company, no recovery seeds were exposed: those are the secret word lists that would let an attacker drain a wallet entirely.
A Trezor hardware wallet stores the secret keys to someone's cryptocurrency offline, beyond the reach of a remote hacker. That protection is unchanged. The leak is about who bought a wallet and where it was shipped, not what's on the wallet.
How did this happen at ShipMonk?
ShipMonk is a third-party fulfilment company that packs and ships parcels on behalf of other businesses. Trezor used it for U.S. Deliveries during that 2019 to 2021 window, and the breach happened inside ShipMonk's systems, not Trezor's.
This is a familiar pattern: the supplier gets breached, and the supplier's customer ends up doing the apologising. Trezor said it had been assured the affected records were deleted. They weren't.
| Detail | Figure |
|---|---|
| Newly disclosed U.S. Customers affected | 67,000 |
| Order date range | Nov 2019 to Aug 2021 |
| Data exposed | Name, email, phone, address, order number |
| Wallet security impact | None |
| Source of breach | Shipping provider ShipMonk |
Should Trezor owners be worried?
The wallets are safe, but the social engineering risk is real. Anyone on that shipping list is now a known crypto owner with a verified home address, exactly the profile fraudsters look for. We reported a similar situation on 17 August when SafePal disclosed a breach hitting nearly 40,000 wallet customers, and the downstream scam patterns were identical.
Expect emails naming an old order number. Texts claiming a delivery problem are also likely, as are letters in the post pretending to be from Trezor support, asking you to "verify" your wallet by entering your recovery seed. That last one is the classic crypto trap: Trezor will never ask for the seed, and typing it anywhere hands over the coins.
If a message pushes you to open an attachment or hand over your recovery words, treat it as hostile. Go to the Trezor website by typing the address yourself.
The wider point
Supply-chain leaks like this rarely make the security world's front page, because there's no clever exploit involved. No zero-day, meaning a previously unknown software flaw, and no ransomware crew taking credit. Just a fulfilment vendor holding customer records for years longer than anyone realised, and a deletion assurance that didn't hold up. For a company whose customers are, by definition, holders of bearer assets, that ordinary failure carries an unusually sharp edge.
