With violent crypto home invasions surging, a data breach exposing over 10,000 Trezor owners puts physical safety on the line
On Aug. 13, Trezor said a breach at the success supplier ShipMonk uncovered buyer data for about 13,689 {hardware} pockets consumers, together with the supply addresses of 11,742 folks.
The bigger group had their names, e mail addresses, telephone numbers, and delivery addresses uncovered, whereas one other 1,947 clients had names, cities, and e mail addresses compromised. ShipMonk dealt with the data to meet and ship Trezor orders.
Trezor mentioned its personal techniques, units, and providers weren’t breached and that buyer wallets stay safe. The publicity as an alternative creates a completely different danger: linking identifiable folks and, usually, their home addresses to the buy of a {hardware} wallet designed to safe crypto holdings.
ShipMonk notified Trezor on Aug. 10 that an unauthorized actor had accessed techniques containing buyer data, in line with the firm’s Aug. 13 disclosure.
The 11,742 totally uncovered data coated orders obtained between May 10 and Aug. 8. The extra 1,947 data might embrace older purchases, and Trezor mentioned it was nonetheless working with ShipMonk to find out why these data remained accessible.
Trezor mentioned its success companions are typically required to delete or anonymize order data inside 90 days of supply, thereby limiting how a lot latest buyer data stays accessible after an order is accomplished.
Shipping data can flip a digital breach into a physical-security danger
While the uncovered data don’t present entry to wallets or personal keys, they will make phishing and different assaults considerably extra focused.
Trezor warned that scammers may use the data to impersonate the firm, banks, or crypto exchanges via convincing emails, telephone calls, and letters. An attacker who already is aware of that a individual purchased a Trezor system can tailor a message round pockets safety, compromised funds, or supposed account issues fairly than relying on generic phishing tactics.
The inclusion of supply addresses raises a extra critical concern as a result of it will possibly determine households related to people who find themselves prone to personal crypto.
That doesn’t imply the ShipMonk data has been used for physical assaults. However, earlier instances present how buyer databases will help criminals determine potential crypto holders earlier than shifting from on-line reconnaissance to real-world concentrating on.
In a 2025 case unrelated to Trezor, the US Justice Department described an alleged crypto-theft community that used stolen databases to determine victims and included residential burglars concentrating on hardware-wallet owners.
Chainalysis has additionally discovered that the annual worth stolen via violent crypto assaults reached a report $58 million in 2025, with one other $30 million stolen by the center of 2026. Home invasions accounted for 37% of recorded incidents this 12 months, up from 26% in 2023.
The blockchain analytics agency mentioned attackers vary from criminals who ship stolen property on to centralized exchanges to extra subtle teams utilizing laundering infrastructure to obscure the proceeds.
Trezor and crypto executives push tighter privateness measures
Following the latest wave of third-party data breaches affecting crypto service suppliers, business leaders are more and more warning about the dangers of overexposed consumer data.
Helius co-founder and CEO Mert Mumtaz said breaches involving buyer data will proceed to happen throughout software program suppliers, arguing that crypto customers ought to scale back the quantity of non-public data that may be related throughout providers.
Among his suggestions have been utilizing separate e mail aliases, distinctive passwords and hardware-based multi-factor authentication fairly than SMS. He additionally urged customers to keep away from offering pointless private particulars and, the place potential, to have delicate merchandise delivered to shared or non-residential places fairly than their houses.
Mumtaz additionally argued that a hardware wallet shouldn’t be handled as enough safety for substantial holdings, recommending multi-signature setups so compromising a single system or signer can not expose a complete steadiness.
Trezor is taking a comparable method on the success aspect by attempting to scale back the quantity of delivery data that is still connected to future purchases.
The firm mentioned it plans to introduce Anonymous Delivery in the European Union by September 2026 and in the US by the finish of the 12 months. The service would use a devoted checkout course of, locker pickup, impartial packaging, and generic sender particulars, with delivery identifiers mechanically deleted after supply.
For clients affected by the ShipMonk incident, Trezor suggested treating pressing requests for data with suspicion, verifying messages via official channels, and by no means sharing a pockets backup or getting into one into a web site.
The submit With violent crypto home invasions surging, a data breach exposing over 10,000 Trezor owners puts physical safety on the line appeared first on CryptoSlate.
