Trezor Expands Breach Disclosure: 67,000 Additional Customers Hit by ShipMonk Data Leak

Trezor just dropped another bombshell on its customer base. The hardware wallet maker disclosed that a separate tranche of data from its fulfillment partner ShipMonk has exposed an additional 67,000 customer records, extending the damage well beyond initial assessments.

Here's what we're looking at: the newly discovered records span 2019 to 2021 and contain personally identifiable information including names, emails, phone numbers, shipping addresses, and order numbers. For context, this follows Trezor's earlier disclosure of a major breach affecting their customer database—but this fresh wave shows the incident's reach is far wider than previously acknowledged.

The records themselves don't include sensitive financial data like private keys or cryptocurrency holdings, which is the silver lining here. But the combination of PII and order history creates a legitimate security concern. Bad actors now have a roadmap of who bought hardware wallets, when they bought them, and where they can be reached. That's gold for social engineering attacks, phishing campaigns, and targeted scams aimed at crypto holders.

What This Means for Affected Users

If you're in the crypto trading or portfolio management space, this is a wake-up call about third-party risk. Trezor didn't get breached directly—their fulfillment partner did. That means your security posture depends not just on the company you trust, but on every vendor in their supply chain. ShipMonk handles logistics for dozens of companies, so the blast radius extends far beyond just hardware wallet customers.

The 2019-2021 timeframe is particularly relevant because it captures a period of massive crypto adoption and bull market activity. Anyone who bought a Trezor during that window—when hardware wallets were becoming mainstream security tools for serious traders—is now flagged in attackers' databases.

The Bigger Picture

This disclosure adds another data point to the growing list of crypto infrastructure vulnerabilities we're tracking. Between exchange hacks, bridge exploits, and now supply chain breaches, the ecosystem's operational security remains a persistent weak point. Companies handling sensitive customer information need to implement stricter vendor oversight, encryption standards, and breach notification protocols.

Trezor has advised affected customers to monitor their accounts for suspicious activity and remain vigilant against phishing attempts. Standard guidance, but it's the minimum bar when millions of data points are floating in the dark web.

The crypto community should treat this as a reminder: even when you do everything right—using hardware wallets, maintaining operational security—you're still exposed to risks outside your control. Portfolio managers and traders should assume their information is compromised and adjust their security practices accordingly.