- Trezor’s breach now covers more than 80,000 customers after a second disclosure.
- The 67,000 newly exposed U.S. buyers ordered between November 2019 and August 2021.
- ShipMonk had given Trezor written confirmation that this data no longer existed.
- Recovery seeds and private keys were never accessible at any stage.
Trezor confirmed that roughly 67,000 additional U.S. customers had their names, emails, phone numbers, shipping addresses and order numbers exposed through fulfillment partner ShipMonk, pushing the incident past 80,000 people worldwide. These records date from orders placed between November 2019 and August 2021 – a window Trezor believed had been wiped from ShipMonk’s systems years ago, based on written assurances the logistics provider had supplied on request.
Two days ago, we received an update from our shipping provider, ShipMonk. We're deeply saddened to share the news that the recent data breach affects more customers than originally thought.
Another 67,000 customers from the US who ordered between November 2019 and August 2021… https://t.co/yDQvTlAA2S
— Trezor (@Trezor) September 4, 2026
A 90-day retention policy that a supplier quietly ignored for five years
Trezor holds fulfillment data for 90 days. That policy is the entire reason the company expected its August 13 disclosure to be the final word: 13,689 customers across seven countries, all of whom had ordered within the three months preceding August 8. ShipMonk had repeatedly certified in writing that the older 2019-2021 records were gone.
They were not. Half a decade of U.S. order data sat on a vendor’s servers, invisible to the company legally responsible for it, and became available the moment that vendor was breached. Trezor’s public response singled out ShipMonk’s failure to honour a contractual deletion commitment – a rare instance of a crypto firm naming its supplier rather than absorbing the reputational cost quietly.
ShinyHunters got in through a reporting tool, not a wallet
Security researchers attribute the ShipMonk intrusion to the ShinyHunters extortion group, which exploited an unpatched SQL injection flaw in Metabase, the business intelligence software ShipMonk used internally. SQL injection tricks a database into running queries it was never meant to run; because the flaw was a zero-day, no fix existed when the attack landed. The same Metabase flaw, tracked as CVE-2026-72898 and rated 10.0 on the CVSS severity scale, also appears in reporting on the Bits of Gold breach, where the broker’s analytics platform ran its own self-hosted instance. That places two of the month’s largest crypto data leaks on one unpatched piece of software rather than on three unrelated vendor mistakes.
Trezor’s firmware, devices and seed generation were untouched, and no private key was ever within reach of the attackers. The intrusion happened several layers away from the hardware, inside the commerce plumbing that every physical product depends on.
Why a shipping address is worth more than an email dump
Anyone holding this dataset knows exactly who bought a hardware wallet, when, and where they live. That combination powers letters, calls and emails that cite a genuine order number and sound authentic enough to walk a victim toward disclosing a seed phrase.
Ledger’s customers have lived through the full arc of this. An API key vulnerability in 2020 exposed roughly 1 million email addresses and about 272,000 records containing full name, postal address and phone number, and once the file circulated on hacking forums, victims received fraudulent support calls and physical mail containing counterfeit replacement devices carrying seed-extraction malware. Trezor buyers now sit on the same starting line.
Three vendor failures in a single August
- SafePal: an authorization flaw in a third-party order-tracking plug-in exposed 39,798 customers’ purchase histories, names and emails. Wallet infrastructure and funds were untouched, and SafePal has since cut its own data retention to 90 days and taken down more than 30 phishing sites built off the leak.
- Bits of Gold: Israel’s largest regulated crypto broker saw roughly 200,000 customer records exposed through a breached third-party data analytics provider, including national ID numbers, bank account details and public wallet addresses.
CertiK counted 52 verified wrench attacks in the first half of 2026, up 33% from 39 a year earlier, with home invasion overtaking kidnapping as the dominant method and recorded exposure reaching $124.1 million. A leaked shipping address is the input that attack pattern runs on. None of these breaches involved firmware or cryptography. Attackers unable to defeat a secure element are instead buying the customer list from whoever mails the box.
Anonymous delivery is the fix Trezor is now building
Trezor has emailed affected customers directly from its official help address on the trezor.io domain, and says it is developing an anonymous delivery option that strips personal data from the shipment record itself. That shifts the defensive line: instead of trusting suppliers to delete data on schedule, the aim is to never hand it over. Whether competitors follow, and whether logistics providers can operate on minimal identifying data at scale, will determine if this remains a Trezor feature or becomes the industry’s default.