80,700 Trezor Buyers Just Had Their Home Addresses Leaked. No Wallet Was Touched, and That Is Not the Point

Disclosure: Some links on this page are affiliate links. If you purchase through them, we may earn a commission at no extra cost to you. Full affiliate disclosure.

The whole pitch of a hardware wallet is that the keys never touch a networked computer. Someone on another continent can send you phishing email all week and still end up with nothing, because the seed phrase is written on a card in a drawer. On September 4, 2026, Trezor disclosed a breach that respects that boundary completely — and makes the one attack a hardware wallet cannot stop substantially easier to carry out.

The company's fulfillment vendor, ShipMonk, was breached. The exposure now covers roughly 80,700 US customers, up from the roughly 13,700 Trezor first disclosed on August 13. The fields are full name, email address, phone number, and home shipping address, tied to orders placed between November 2019 and August 2021.

No wallet was compromised. No private keys, no seed phrases, no funds lost. Trezor's own systems were never breached. Every one of those sentences is true, and for 80,700 people none of them is the sentence that matters.

Editor's Take

The whole value proposition of a hardware wallet is that keys never touch a networked machine, and this breach did not contradict that — no wallet was accessed. What it did expose is the part people forget: the physical world around a crypto holder. A home address tied to a known hardware wallet purchase is a burglary and extortion risk, which is a threat model no amount of key hygiene addresses.

Read That Field List Again, in Order

Most breaches leak credentials or contact details, and the advice that follows is built around replacement: change the password, cancel the card. This leak contains no replaceable secret at all. It contains four ordinary facts about a person, and the damage is in how they combine.

A name and an email address get you phishing. A name, a phone number and a home address, attached to the purchase of a device whose only function is holding cryptocurrency, get you something else: a list of households that almost certainly hold crypto, with the door number already written down.

That is the entire reconnaissance problem solved. Criminals looking for physical targets have historically had to do the slow work of finding people worth robbing — exchange leaks, forum posts, conference photos, on-chain tracing. Here the filter is pre-applied. Everyone on this list bought a hardware wallet, which means everyone on this list self-identified as someone with assets worth protecting offline.

The Physical Risk Is Not Hypothetical Anymore

Security researchers call these wrench attacks: instead of defeating the cryptography, you use violence, home invasion or kidnapping to compel the person who holds the keys to hand them over. The encryption is irrelevant. So is the quality of your seed phrase storage.

CertiK's figures for the first half of 2026 should be read by anyone on this list:

• 52 verified wrench attacks in H1 2026, up 33% from 39 in the same period of 2025
• $124.1 million in recorded financial exposure, against $10.5 million a year earlier — roughly a twelvefold increase
• average recorded loss per incident climbed from about $270,000 to $2.39 million
• home invasions went from one publicly reported case in early 2025 to 20 in H1 2026, about 41% of everything CertiK tracked
• kidnappings rose from 12 to 16

The concentration is European, and France alone accounts for 33 of the 52. That is worth stating plainly rather than using it as reassurance: the Trezor list is US customers, and the surge CertiK documented is somewhere else. But the mechanics do not care about borders. A crew that assembles target packages from leaked databases will use a US list the same way it uses a French one, and home invasion — the tactic that grew from one case to twenty in a year — is the tactic that needs an address.

A Dashboard, Not a Heist

The entry point is almost insultingly mundane. ShipMonk used Metabase, a business analytics tool, to query its own databases. Metabase had a SQL injection zero-day, CVE-2026-72898, rated CVSS 10.0.

The extortion group ShinyHunters used it to create administrator-level sessions and bulk-download customer data tables, then contacted ShipMonk directly with extortion demands.

Nobody fell for an email. Nobody reused a password. No employee was socially engineered. An internal reporting tool sat in the path of everything, and one unpatched flaw in it was enough to pull years of shipping records out in bulk. This is the same shape as the BigBear credential operation in one respect: the defenders were watching the front door, and the loss happened through a side system nobody in the security programme owned.

"We Asked. They Said It Was Deleted."

Here is the part that should bother people more than the vulnerability.

Trezor says it repeatedly asked ShipMonk to confirm that older order records had been deleted, and received written assurance that they had been. They had not been. The data was still sitting there years after the business relationship it came from had ended.

That is a governance failure with a very long half-life. A zero-day gets patched and the exposure window closes. Retention that was promised and not performed means the data sat in a reachable system every single day for years, waiting for whichever vulnerability eventually arrived. The breach was not caused by the decision to keep the data, but keeping the data is what made the breach worth 80,700 records instead of zero.

And the written assurance is the detail to sit with. Organisations treat vendor attestation as a control, but an attestation is a claim, not a deletion. Until someone can prove a record is gone from the analytics replica and the backup as well as the primary table, "we deleted it" is a sentence with no mechanism behind it.

What To Do If Your Address Is In It

• Assume the phishing will be good. Trezor has specifically warned about contact that references your real order history, because that is exactly what the leaked data makes possible. A message that knows what you bought and when proves nothing about who sent it.
• Never act inside the message. If something claims to be from Trezor or ShipMonk, close it and navigate to the official site yourself. Any link in an unsolicited email is the attack, regardless of how accurate the order details are.
• Treat a seed phrase request as proof of fraud. No legitimate support process at any hardware wallet maker asks for it. Not by email, not by phone, not by a form. There is no version of this conversation that ends legitimately.
• Check what else resolves to your address. The reason a leak like this compounds is that it joins up with broker records — who lives there, what they own, who else is at the address. Our data removal services comparison covers what actually gets taken down.
• Watch for the physical tells too. Unsolicited service visits, strangers asking about a delivery, unexpected packages. A crew doing reconnaissance does not always start with an email.
• Change what you ship to. For anything security-adjacent in future, a pickup point or a work address puts a buffer between your purchase history and your front door. The label is the record, so the label is what needs to be wrong.
• Set up monitoring that would catch reuse. Our dark web monitoring guide explains how stolen datasets surface, and our identity theft protection comparison covers the monitoring-with-credit-attached version.

This is the second time in a month Trezor has had to expand this disclosure, which is itself worth noting: the first number was wrong, and the corrected number came with the field that actually matters. For the general triage sequence after any exposure, our data breach response guide walks through it in order, and our phishing identification guide covers the specific tells in a message. The IDScan driver's license breach is the parallel case where the exposed data also could not be reissued.

The Honest Read

Trezor's security held. There is no evidence anywhere in this incident that the company did something careless with keys, firmware or customer credentials. What failed was one hop out: a warehouse company with an old spreadsheet's worth of addresses and an analytics tool nobody patched.

That is the uncomfortable shape of modern breaches. You can do everything right — short retention policy, contractual deletion requirements, and the discipline to ask for written confirmation — and still end up on the wrong side of a headline, because the organisation that actually holds your data is not the one whose name you chose to trust.

For the people on this list, the practical takeaway is not "Trezor is unsafe." It is that a hardware wallet protects you from every attacker except the one who knows where you live, and 80,700 of you just had that information handed to a group that sells it.