13,689 Trezor Owners Just Had Their Home Addresses Linked to Crypto Holdings
13,689 Trezor hardware wallet owners have had their names, email addresses, phone numbers, and home addresses exposed through a breach at the company's shipping partner, ShipMonk. The data does not include private keys or seed phrases. It includes something arguably more dangerous: a map from real people to real front doors, each marked as a household that likely holds cryptocurrency.
ShipMonk notified Trezor on 10 August that an unauthorised actor had accessed systems containing customer order data. Trezor disclosed the breach on 13 August. Of the 13,689 affected customers, 11,742 had full names, email addresses, phone numbers, and shipping addresses exposed. A further 1,947 had names, cities, and email addresses compromised. The fully exposed records cover orders placed between 10 May and 8 August 2026.
Trezor's own systems, devices, and services were not breached. Customer wallets remain secure. The exposure sits in a different category, one that matters as much for physical safety as for digital security.
Why a shipping address is a targeting list
Hardware wallets exist because self-custody removes trust in third parties. But buying one requires shipping it somewhere. That transaction creates a record, name, address, phone, linking a specific person at a specific location to the purchase of a device designed to store cryptocurrency.
In isolation, that record is an administrative detail. In a breach database, it is a targeting list.
Chainalysis reported that the annual value stolen through violent crypto attacks reached a record US$58 million in 2025, with another US$30 million stolen by the middle of 2026. Home invasions accounted for 37% of recorded incidents in 2026, up from 26% in 2023. In a 2025 case described by the US Justice Department, an alleged crypto-theft network used stolen customer databases to identify victims before dispatching residential burglars to target hardware-wallet owners.
The Trezor breach does not mean those 13,689 people will be physically attacked. It means a dataset now exists, outside Trezor's control, that links identifiable households to likely crypto holdings. The gap between a secure wallet and a secure owner has just widened.
The phishing multiplier
The more immediate risk is targeted social engineering. An attacker who knows you bought a Trezor can craft a convincing email about a firmware update, a security recall, or a compromised wallet. The message arrives with your name, your address, and enough order detail to look legitimate. Trezor warned that scammers could impersonate the company, banks, or exchanges using the exposed information.
This is not theoretical. Hardware wallet owners are already a preferred phishing target. A breach that provides names, phone numbers, and shipping addresses makes those phishing attempts dramatically more credible, and harder to distinguish from genuine manufacturer communications.
What this means for digital estate planning
If you hold crypto as part of your estate plan, this breach exposes a problem that goes beyond the wallet itself. Your estate plan probably documents where your hardware wallet is stored, where the seed phrase is kept, and how your executor can access your holdings. It almost certainly does not account for the possibility that a third-party vendor already leaked your name and home address into a database circulating among criminals.
The Trezor breach is the second hardware-wallet incident in two weeks with direct estate-planning implications. Earlier this month, a five-year-old Coldcard firmware flaw was linked to US$120 million in stolen bitcoin, not because keys were shared, but because the seed-generation process itself was flawed. Together, these incidents make clear that self-custody is not a single act. It is a dependency chain, and every link in that chain can fail.
What to do now
If you purchased a Trezor device between May and August 2026, assume your shipping details are exposed. Take these steps:
- Do not trust inbound communications. Any email, phone call, or letter claiming to be from Trezor about this breach should be treated as phishing. Verify through Trezor's official website directly, do not click links in messages.
- Never share your seed phrase. No legitimate company will ask for your recovery phrase to "check" whether it was affected. Anyone who does is a thief.
- Consider delivery opsec for future purchases. Have hardware wallets delivered to a PO box, parcel locker, or non-residential address. The Helius CEO Mert Mumtaz recommended this after the breach, along with using separate email aliases and hardware-based multi-factor authentication.
- Review your estate plan's security assumptions. If your digital directive references a hardware wallet, document the device model, firmware version, and seed-generation date, so your executor can check whether security advisories have changed the picture since you wrote it.
- Evaluate multisignature setups. A single device should not be the sole protection for substantial holdings. Multisig means compromising one device or one person is not enough to access the funds.
The third-party problem
Trezor did everything right with its own systems. The breach happened at a fulfilment partner. This is the pattern that makes digital estate planning harder than it looks: your security is only as strong as the weakest link in your supply chain, and most of those links are invisible to you.
The Verizon 2026 DBIR found that 30% of all breaches now involve third parties, up from 15% the year before. Your data is not just held by the companies you chose. It is held by their shipping partners, their cloud providers, their payment processors. Each one is a potential breach surface that your estate plan cannot directly control.
A Digital Directive from NYLK maps these dependencies, not just where your assets live, but the third-party relationships that touch them, so your executor knows what to monitor when a breach like this hits. Because the next Trezor-scale leak is not a question of if, but when.
Your crypto security extends beyond your wallet. NYLK Digital Directives map your full digital asset footprint, including third-party dependencies, with verified executor release.
Sources
Your digital life, held safe for the people you love.
NYLK builds the Directive that makes sure the people you love aren't locked out.
Start your Digital Directive →