ShipMonk

The biggest vulnerability in your Bitcoin wallet might be the shipping label

4d ago

Trezor breach exposes 80,689 customers to phishing through retained shipping records

Blockchain Bitcoin Security, Data Breach, Hardware Wallets, Private Keys, ShipMonk, Trezor, Wallet Protection

BitcoinSeptember 12, 2026·3 min read

Hardware wallet manufacturers collect names and addresses essential for delivery, but these details can persist in vendor databases for years and become tools for targeted phishing attacks against Bitcoin holders. A Trezor breach affecting 80,689 customers demonstrates how shipping records, considered temporary operational data, expose users to identity-based social engineering even after devices arrive and private keys remain secure.

Trezor disclosed that approximately 67,000 additional US customers were affected by a ShipMonk breach, with records spanning 2019 to 2021 orders.
Leaked information included only contact and delivery details; no private keys, wallet contents, or funds were exposed or stolen.
Physical mail and personalized email using shipping data enable convincing phishing campaigns targeting wallet recovery words, bypassing device-level security.

80,689 Total Trezor customers affected by shipping provider breach disclosure overall
2019-2021 Years covered by affected orders in the Trezor ShipMonk incident
0 Financial losses reported so far despite customer data exposure

Hardware wallet manufacturers sell security by keeping private keys isolated from internet-connected computers, yet the purchase process creates an unprotected record that outlasts the device’s usefulness. According to reporting on the incident, Trezor’s Sept. 4 update to its shipping-provider breach disclosure revealed that ShipMonk, the fulfillment vendor, retained customer contact and delivery information from orders placed years earlier. Trezor confirmed that its own systems and devices were unaffected, that parcel contents remained secure, and that no financial theft occurred. But the absence of immediate financial loss masks a persistent vulnerability: a home address tied to a Bitcoin purchase creates a permanent target for impersonation and social engineering.

Shipping records enable targeted phishing campaigns against wallet owners

A thief with a customer’s name and address can craft messages that feel legitimate in ways generic spam cannot. Ledger’s record of phishing campaigns documents instances of physical letters directing recipients to scan codes or visit fraudulent websites where they are prompted to share recovery words. An email addressed to you by name, referencing an order from years ago, carries far more credibility than a mass mailing sent to millions.

Letters delivered to your home can easily mimic official correspondence, even when their instructions are fraudulent.

The attack succeeds not by compromising the hardware wallet itself but by persuading the owner to voluntarily hand over backup recovery words, the only credential that bypasses device-level protection entirely.

A name and address alone cannot drain a wallet, but they transform a broad attack into a precision strike against someone the scammer can credibly impersonate as a business or service provider the customer once trusted.

Permanent data retention exposes customers long after purchase purposes expire

Shipping information serves a legitimate short-term function: routing parcels, resolving delivery failures, and processing returns. That temporary operational need does not justify permanent storage. The Federal Trade Commission’s business guidance establishes a straightforward principle: collect and retain sensitive information only for a legitimate business need, know where it goes, and dispose of it securely. Yet retailers and their fulfillment partners routinely retain old records in database replicas, support-system exports, and backups long after removal from active systems.

A deletion clause in a contract and a vendor’s assurance that records were removed are not the same as direct evidence that every storage system, including replicas, exports, and backups, actually applied the retention policy. Manufacturers choose the warehouse and negotiate the contract, giving them leverage to demand proof of secure disposal. Most do not.

Home addresses remain valid long after the original purchase is forgotten, and a copied record cannot be recalled from everyone who received it.

Manufacturers must demand evidence of data deletion, not accept vendor assurances

Protecting the person who buys a hardware wallet requires manufacturers to establish retention limits before a breach occurs. This means collecting less information where possible, separating data that does not need to travel together, and requiring vendors to prove that old records have been securely deleted when their operational purpose expires.

A parcel locker, neutral packaging, or a separate contact detail for online orders can reduce attack surface, but none of these measures eliminate the retailer’s own database records.

Trezor’s breach demonstrates that contract language alone is insufficient; manufacturers must implement processes to verify deletion across all systems where data is stored or replicated, establish clear retention deadlines tied to operational necessity rather than administrative convenience, and hold vendors accountable with periodic audits rather than one-time assurances. Until hardware wallet makers demand and verify evidence that shipping records are actually removed, buyers will remain exposed to targeted phishing campaigns years after their devices arrive and their private keys are secured.

Get this in your inboxThe Crypto Coin Show newsletter covers the policy and market moves institutional crypto investors are pricing in.

Sep 5, 2026

Users exposed by Trezor breach grows sixfold after supposedly deleted shipping logs are found

Blockchain Customer Data Exposure, Cybersecurity, Data Breach, Hardware Wallet Security, ShipMonk, Trezor

BlockchainSeptember 5, 2026·5 min read

Hardware wallet maker Trezor disclosed that a breach at its logistics provider ShipMonk exposed approximately 67,000 additional U.S. customers, six times the initial count, after supposedly deleted shipping records from 2019 to 2021 remained in the vendor’s systems despite written assurances of deletion. The incident expands institutional custody and consumer protection risks in an ecosystem where hardware wallets have become central to asset security strategies, and raises questions about third-party data retention practices across the blockchain infrastructure stack.

Trezor’s disclosed exposure expanded from 13,689 to roughly 80,689 customers after logs deleted per policy remained at ShipMonk for years.
Exposed data spans November 2019 through August 2021 and includes names, emails, phone numbers, addresses and order numbers, linking individuals to hardware wallet purchases.
Trezor received written deletion assurances from ShipMonk multiple times, yet records persisted; the breach originated from a Metabase analytics platform zero-day vulnerability.

67,000 Additional U.S. customers exposed in Sept. 4 update versus initial August disclosure
80,689 Approximate total customer count exposed across both disclosure periods combined
90 days Trezor’s stated data retention policy window before deletion from partner systems

On September 4, Trezor announced a significant revision to its August 13 disclosure of a security breach at ShipMonk, its third-party logistics provider. The new update revealed that approximately 67,000 additional U.S. customers had been exposed, a figure that dwarfs the originally disclosed 13,689 affected users and brings the total known exposure to roughly 80,689 people.

The breach exposed contact and order information spanning November 2019 through August 2021, including names, email addresses, phone numbers, shipping addresses and order numbers.

Critically, the newly discovered records had persisted in ShipMonk’s systems despite Trezor’s written deletion requests and the company’s stated 90-day data retention policy, which requires customer information to be purged from both Trezor and partner systems after that window expires.

Trezor received written deletion assurances that ShipMonk failed to honor for years

The breach represents a stark failure in third-party data governance. Trezor stated that it had “repeatedly requested and received written assurances” that ShipMonk had deleted historical customer records, yet the vendor retained data going back to 2019, nearly six years before the breach discovery.

Trezor’s published delivery-data policy explicitly commits to a 90-day deletion window, with limited exceptions for ongoing order fulfillment issues. The company did not disclose the dates of the assurance letters ShipMonk provided or publish the correspondence itself, leaving unclear how frequently Trezor verified compliance or what triggered the discovery that the deletions had never occurred.

The incident compounds institutional custody risks at a moment when large asset managers and financial institutions have begun integrating hardware wallets into qualified custody workflows. A breach that exposes physical addresses linked to hardware wallet purchases creates attack surface unavailable in conventional securities infrastructure.

Trezor emphasized that the breach did not compromise wallet cryptographic material, no recovery seeds, private keys or wallet funds were exposed, and that the company’s devices and systems remained secure.

The risk instead emanates from the peripheral data: the connection between an identified individual, a physical location and a confirmed hardware wallet purchase can inform convincing social engineering, fraudulent communications or physical targeting.

Trezor acknowledged that the exposed information could support scam emails, fraudulent calls or letters and potential physical targeting.

Metabase zero-day vulnerability opened ShipMonk’s systems to unauthorized access

According to BleepingComputer reporting, ShipMonk’s breach originated from an unpatched vulnerability in Metabase, an open-source analytics platform. The August zero-day flaw allowed an attacker to create a session tied to an administrator account and execute bulk table downloads without authentication.

This attack vector gave an unauthorized actor direct access to ShipMonk’s historical order database, exposing records that should have been purged years earlier under Trezor’s contractual retention policy. The vulnerability represented a known security risk in a widely deployed analytics tool, underscoring the cascade effect when third-party vendors fail to patch critical infrastructure.

The distinction between Trezor’s systems and ShipMonk’s infrastructure is crucial for institutional risk assessment. Trezor’s own systems, products and services were not compromised, and the security of devices themselves remained intact.

However, the vendor relationship created a trust assumption that proved unfounded: Trezor relied on ShipMonk’s adherence to data deletion practices, monitoring and security posture without publishing the contractual terms, audit frequencies or remediation timelines that would normally govern such arrangements.

The expanded disclosure suggests Trezor did not discover the data retention failure through its own audit but rather through ShipMonk’s post-incident investigation or external security review after the Metabase vulnerability was exploited.

The breach did not reach Trezor’s wallet systems, and devices remained secure; the risk centers on the peripheral identity and physical location data.

No confirmed downstream attacks documented, but physical targeting risks remain open

As of the September 4 update, Trezor reported no confirmed downstream attacks using the exposed dataset. This absence does not eliminate the risk: datasets linking identifiable individuals to high-value asset infrastructure typically attract targeting by organized crime, fraud rings and state-level actors.

The data’s composition, names, addresses, phone numbers and explicit hardware wallet purchase records, creates a targeting list of known asset holders, a category substantially more valuable than generic contact databases or email leaks that trade in underground forums at single-digit dollar costs per thousand records.

The institutional implications extend beyond individual customer risk. Regulated entities integrating Trezor or other hardware wallet solutions into custody infrastructure must now factor third-party logistics and data retention failures into their vendor risk assessments.

The incident demonstrates that even companies with published data policies and contractual safeguards cannot guarantee compliance from partners without rigorous verification, audit trails and financial penalties for non-compliance.

For asset managers and financial institutions currently evaluating hardware wallet custody solutions, the Trezor-ShipMonk incident provides a case study in the operational complexity and third-party dependencies that peripheral custody solutions introduce compared to fully managed, regulated custodians.

Trezor has not disclosed whether the 13,689 originally affected users and the 67,000 newly disclosed users represent entirely separate populations or whether there is overlap between the groups.

The company’s use of the phrase “another approximately 67,000” suggests it considers the new figure additional, but without published data or group analysis, institutional investors cannot determine the true scope of customer exposure or assess whether their own address data appears in either disclosure.

Trezor has not published the underlying data, the assurance letters from ShipMonk, or a clear accounting of how many total unique customers were exposed across both disclosure periods, leaving institutional counterparties unable to independently verify customer risk exposure or conduct their own impact assessments. The company’s next disclosure should include the specific dates of ShipMonk’s deletion assurances, the audit frequency Trezor employed to verify third-party compliance, and a consolidated customer count with overlap analysis to enable informed custodial decisions.

Get this in your inboxThe Crypto Coin Show newsletter covers the policy and market moves institutional crypto investors are pricing in.

Aug 14, 2026

CZ Says Software Wallets Avoid Risks Seen in Trezor Leak

Blockchain Changpeng Zhao, Crypto Security, Hardware Wallets, ShipMonk, Software Wallets, Trezor, Trust Wallet

BlockchainAugust 14, 2026·6 min read

A data breach at Trezor’s shipping partner has exposed the home addresses of 13,700 customers, triggering a high-profile debate about the security trade-offs between hardware and software self-custody wallets. For institutional investors evaluating custody infrastructure, the incident underscores that physical device shipment creates distinct vulnerabilities absent from software-only solutions, even as hardware wallets retain advantages in protecting private keys from online attack.

Trezor disclosed that ShipMonk, its logistics partner, suffered a breach exposing names, phone numbers, and home addresses of approximately 13,700 recent customers.
Binance founder CZ argued the breach demonstrates a real security advantage of software wallets like Trust Wallet and Binance Web3 Wallet, which require no physical shipment linking identity to crypto holdings.
Security researchers flagged that exposed customer addresses could enable targeted physical attacks, social engineering campaigns, and wrench attacks against known hardware wallet owners.

13,700 Recent Trezor customers affected by ShipMonk data breach exposure
$100M+ Bitcoin stolen in separate Coldcard firmware randomness vulnerability
Mid-July ZachXBT public criticism of all hardware wallets as unsuitable for serious use

On August 13, hardware wallet manufacturer Trezor acknowledged that ShipMonk, a third-party logistics provider handling its customer shipments, had suffered an unauthorized data breach exposing the personal information of roughly 13,700 recent buyers.

The compromised dataset included names, phone numbers, and home addresses, data that ties individual customers directly to physical locations while revealing them as cryptocurrency owners. ShipMonk had notified Trezor of the incident on August 10 after detecting unauthorized system access, prompting the public disclosure three days later.

The breach created an immediate institutional quandary: how to weigh the cryptographic security advantages of hardware wallets against the operational and privacy risks introduced by physical distribution supply chains.

CZ Contrasts Hardware Shipment Risk Against Software Wallet Privacy Model

Binance founder Changpeng Zhao responded within days, using the incident to make a structural argument about custody architecture. He acknowledged that hardware wallets have earned their reputation for superior protection of private keys against online compromise, writing that the advantage is “generally true” in specific technical aspects.

However, he argued that Trezor’s breach revealed a material blind spot in the hardware wallet security model: physical shipment logistics create a paper trail linking customer identity, crypto ownership, and home address in a centralized vendor database.

CZ highlighted software self-custody solutions including Binance Web3 Wallet and Trust Wallet as alternatives that eliminate this particular attack surface.

Those products generate wallets entirely on client devices without requiring hardware manufacturing, inventory management, or shipping infrastructure, eliminating the need for any company to maintain records of who owns what cryptocurrency and where they live.

His framing avoided dismissing hardware wallets outright; instead, he positioned the two approaches as representing “different risk profiles” suited to different use cases and threat models. He also disclosed that YZiLabs, an investment vehicle he is associated with, holds stakes in multiple hardware wallet manufacturers, signaling that his critique was not ideological.

The distinction cuts to a core tension in cryptocurrency custody that institutional investors have struggled with since the earliest days of the asset class. Hardware wallets solved the problem of how to store private keys securely offline, removing them from internet-connected devices vulnerable to malware and exchange hacks.

But that solution created a new problem: someone has to manufacture, package, and ship the device to the customer, and that supply chain necessarily touches personal data in ways that pure software solutions avoid entirely.

Security Researchers Warn Exposed Addresses Enable Physical Targeting

Beyond the privacy implications, multiple security analysts flagged the concrete physical risks that the leaked address data could enable. NaoX Protocol noted that the exposed list amounts to a verified directory of cryptocurrency holders at specific residential locations, a high-value targeting list for criminals willing to pursue off-chain extortion.

Bitcoin security researcher Nick Neuman warned that the dataset could fuel targeted social engineering campaigns via email, phone calls, or postal mail, and could enable wrench attacks, where attackers use physical coercion to force victims to reveal wallet recovery phrases or sign transactions transferring funds.

Trezor’s own guidance acknowledged the elevated phishing risk, advising customers to expect more sophisticated impersonation attempts and urging them never to enter their wallet seed phrase online or disclose it to anyone.

For institutional investors, the warning underscored a hazard that custody policies and insurance products have historically underpriced: the vulnerability of individual key holders to targeted physical and social pressure when their identity and location become known to determined attackers.

A fund manager holding customer assets through Trezor devices suddenly faces a new class of liability if employees or their families become targets.

The timing and scope of these warnings gained force from the fact that they arrived amid a broader credibility crisis for the hardware wallet category itself.

Trezor Breach Joins String of Hardware Wallet Failures Within Weeks

The ShipMonk breach did not occur in isolation. In mid-July, roughly one month earlier, on-chain investigator ZachXBT had publicly declared that “all hardware wallets are complete garbage” on Telegram, citing dead batteries, forced firmware updates, interface bugs, and poor user experience as systemic problems.

While ZachXBT’s blanket condemnation lacked nuance, his complaint pointed to a real pattern of operational friction that has accumulated in the hardware wallet ecosystem and contradicted the marketing claim that these devices represent seamless, consumer-friendly security.

More significantly, Galaxy Research had linked over $100 million in stolen Bitcoin to a separate critical flaw in older Coldcard hardware wallet firmware.

The vulnerability was not a breach or supply chain attack, but rather a cryptographic defect: the firmware generated wallet seeds using weaker randomness than intended, leaving keys predictable to attackers with sufficient computational resources.

Coinkite, Coldcard’s manufacturer, patched the flaw in newer firmware releases but could not retroactively fix seeds already generated on affected devices. The company advised customers holding Mk3 through Q model Coldcards to migrate their funds to unaffected hardware immediately, a remediation that itself creates operational and custodial complexity.

That the Coldcard vulnerability involved a fundamental cryptographic failure, not mere supply chain mismanagement, meant the two incidents together illustrated the full surface area of hardware wallet risk. Devices can fail both at the point of manufacture and distribution, and the category has no monopoly on security if those foundational engineering and logistics functions break down.

Institutional Custody Decision Now Incorporates Supply Chain and Personnel Risk

For institutional investors and custodians evaluating which self-custody model to recommend or deploy, the accumulated evidence has shifted the calculus. Hardware wallets retain their advantage in isolating private keys from internet-connected systems, a benefit that remains material for defending against remote compromise and exchange hacks.

But that advantage must now be weighed against the concrete costs of supply chain vulnerability, the creation of persistent identity-address links in vendor databases, and the operational burden of device management across organizations with multiple signatories.

Software wallets eliminate the shipment and manufacturing risk entirely, but they shift the security burden onto the user’s own device security and the integrity of the software distribution channel. A compromised phone or laptop can expose keys just as thoroughly as a backdoored hardware device.

The tradeoff is not that one approach is objectively superior, but rather that they distribute risk differently: hardware wallets centralize supply chain and manufacturing risk with the vendor; software wallets distribute key security risk across individual users and devices.

The Trezor breach and the surrounding wave of hardware wallet incidents have made clear that vendors cannot simply assume their supply chain and manufacturing partners will remain trustworthy.

For custodians managing assets on behalf of institutional clients, the implication is that hardware wallet recommendations now require explicit due diligence on the manufacturer’s logistics partners, firmware update processes, and the cryptographic quality of seed generation.

The question facing institutional custody infrastructure is no longer whether hardware or software wallets are categorically more secure, but rather which combinations of hardware, software, and operational controls best match a specific fund’s threat model and risk tolerance. As additional hardware wallet manufacturers face either supply chain breaches or cryptographic vulnerabilities in coming months, a pattern that appears likely given the scrutiny now directed at the category, institutional

Get this in your inboxThe Crypto Coin Show newsletter covers the policy and market moves institutional crypto investors are pricing in.