Trezor's Shipping Partner Leaked 13,689 Home Addresses. The Devices Are Fine. The Owners Are the Target

What Happened

Trezor, the Czech hardware wallet maker, confirmed on August 13 that a breach at its shipping and fulfillment partner ShipMonk exposed order data for 13,689 customers. For 11,742 of them the exposed record is complete for targeting purposes: name, home shipping address, email address, and phone number.

Another 1,947 had partial data exposed. The affected cohort is anyone who received a Trezor order in the 90 days before August 8, concentrated in the US, UK, Sweden, Colombia, Brazil, Italy, and Portugal. Trezor says its own systems were not breached, no devices were compromised, and no keys, seeds, or transaction data were involved.

Affected customers have been notified by email, and the company is warning that the stolen data is already in use: phishing attempts impersonating Trezor and pushing recipients to enter their 24-word recovery seed began circulating almost immediately after the breach.

The intrusion did not happen at Trezor, and not exactly at ShipMonk either. Attackers exploited a critical zero-day vulnerability in Metabase, a widely deployed business analytics platform that ShipMonk ran internally. Metabase disclosed the flaw on August 6: an unauthenticated SQL injection (database commands smuggled through an exposed password-reset endpoint) rated the maximum 10.

0 on the Common Vulnerability Scoring System (CVSS), handing attackers administrative access to self-hosted instances with no credentials required. ShipMonk says its instance was hit that same day, inside the window between exploitation in the wild and the patch. The extortion group ShinyHunters has claimed responsibility for the broader Metabase campaign, which has produced confirmed customer-data breaches at other companies including Framework, the repairable-laptop maker, and the accounting platform Tally.

Your keys never left the device, and the device never failed. What failed was the quiet assumption that buying a security product is a private act. The list of who holds their own keys is now itself the treasure.

The Vendor's Vendor Is the Attack Surface

This is the trust inversion this series keeps documenting, in its purest form yet. Nobody in this incident attacked a wallet. The device's secure element, firmware, and seed generation were never in play. What was attacked was the logistics exhaust of buying one: an analytics dashboard, run by a fulfillment contractor, chosen by the vendor, invisible to the customer.

Your operational security perimeter includes parties you never selected and cannot audit, and the weakest of them defines the boundary. The buyer who researched hardware wallets carefully, verified firmware signatures, and generated a seed offline still ended up exposed, because the exposure happened in a database that existed only to move a cardboard box.

The mitigation that worked deserves naming, because it is rare to see one. Trezor enforces a 90-day retention policy and contractually requires fulfillment partners to delete or anonymize order data 90 days after delivery. That policy is the reason the breach caught 13,689 people instead of every buyer in the company's history.

Compare Ledger's 2020 incident, where a marketing and e-commerce database going back years produced roughly 272,000 leaked order records. Data minimization is usually discussed as compliance hygiene; here it functioned as a blast-radius limiter, the difference between a bad month and a permanent company-scale liability.

The honest caveat: 90 days of orders at a major vendor is still a large, fresh, high-value list, and fresh lists are the ones phishers pay for.

What a Buyer List Becomes: The Ledger Precedent

The 2020 Ledger breach is the reference case for what happens next, and it is not reassuring. Attackers took order data for roughly 272,000 customers (names, phone numbers, and in many cases home addresses) plus more than 1 million email addresses from the company's e-commerce and marketing systems.

The dataset was dumped publicly about 5 months later, and the aftermath ran for years: waves of fake Ledger Live updates engineered to harvest recovery phrases, threatening letters and extortion emails referencing victims' street addresses, and a class-action lawsuit. Ledger reported shutting down 171 phishing sites in a single 2-month stretch.

The lesson the criminal market learned was that a hardware wallet customer list is a pre-qualified lead list: each entry is a person who took custody of their own coins seriously enough to buy dedicated hardware, matched to a physical location.

That lesson has compounded since. As covered here on July 24, CertiK verified 52 physical-coercion incidents against crypto holders in the first half of 2026, with home invasion the leading vector and recorded exposure above $124 million. And as covered on August 4, phishers pivoted within days of the Coldcard entropy flaw to hunt that vendor's own customers through its mailing list.

The fair counterargument is that a name and address is not a balance: most people on the ShipMonk list hold modest amounts, and no attacker mails ransom letters to 13,689 houses. Both things are true. The list does not make everyone a victim; it makes everyone on it cheaply researchable, and the subset with a public footprint suggesting size (social media, business filings, prior leaks) inherits the physical risk.

What This Means for You

If you received a Trezor order this summer, work from the assumption that your name, home address, phone number, and email sit in a dataset that will eventually be sold or published. Your keys are safe and your seed does not need to be rotated; this is not the Coldcard situation, and there is no cryptographic remediation to perform.

The threat is social and physical. Treat every inbound contact that references Trezor (email, SMS, phone call, and eventually physical mail) as hostile until proven otherwise. Trezor will never ask for your recovery seed, and no legitimate process anywhere involves typing your 24 words into a website, an app, or a support chat.

The recovery seed goes into the device and nowhere else, ever.

For everyone else, the durable lesson is that purchase logistics are part of key management. Where practical, ship security hardware to a non-home address: a PO box, a parcel locker, or another receiving point that decouples the product category from your front door. Use a unique email address per vendor so a leak identifies its own source.

And put real weight on vendor data-retention policies when choosing hardware; Trezor's 90-day deletion contract is the only reason this list is not 20 times longer, and not every vendor in this market has one.

Finally, structure your holdings so that a leaked identity cannot become a leaked balance. A BIP-39 passphrase (the so-called 25th word) means a seed surrendered under pressure opens a decoy wallet rather than your savings. Multi-signature arrangements or geographically split keys mean no single household visit can produce the funds.

Self-custody removes custodial risk, the whole point of the hardware, but it relocates the perimeter to you: your address, your habits, your public footprint. The data suggests attackers understand that relocation better every year. The proportionate response is not abandoning self-custody; it is running it like the security operation it is.

What to Watch

Watch whether the ShipMonk dataset surfaces for sale or gets published outright: ShinyHunters' extortion listing for the Metabase campaign currently names no scope, and publication is the event that converts a contained incident into a Ledger-style long tail. Watch for further downstream victims of the Metabase zero-day, including other crypto vendors that use ShipMonk or run self-hosted Metabase instances.

Watch whether phishing against the cohort escalates from email to phone calls and physical letters, the 2020 progression. And watch whether regulators or plaintiffs treat the fulfillment-chain leak as a vendor liability question; the Ledger class action argued exactly that, and a second precedent would start pricing data retention into the hardware wallet market itself.

Tracked entities this report names, with total coverage across the archive. Follow one into the Actor Network to see every report it appears in.

Other reports that name the same tracked actors — a different thread than “related,” which follows wording. These are linked by who appears in them.