Trezor Data Breach Exposes 67,000 More Bitcoin (BTC) Wallet Customers

Trezor Discloses 67,000 Additional Exposed Records

Hardware wallet maker Trezor, whose devices hold Bitcoin (BTC) and other assets in offline cold wallet storage, said Friday that a breach at its shipping partner exposed the personal data of roughly 67,000 additional US customers, lifting the total scope of the incident above 80,000 records. The newly identified records cover orders placed between November 2019 and August 2021 and include full names, shipping addresses, phone numbers, email addresses and order numbers. ShipMonk, the fulfillment provider at the center of the incident, notified Trezor on September 2 that the breach was substantially larger than originally reported. Trezor's first disclosure, published on August 13, counted 13,689 customers — 11,742 of them with full contact details — on orders placed between May and August of this year. The company has not published a combined figure, but the two disclosures together put potential exposure above the 80,000 mark. What makes the expansion unusual, according to Trezor, is that the older records should not have existed at all: the wallet maker says it repeatedly requested and received written confirmation that the data had been deleted. Trezor stressed that its own systems were not compromised and that private keys and wallet backups remain unaffected. The risks it flagged are impersonation and physical safety, since home addresses are among the exposed fields — scammers could pose as banks, a crypto exchange or even Trezor itself in targeted phishing attempts. The company said this is the first time since its 2013 founding that a breach has exposed customer phone numbers and shipping addresses, although a January 2024 support-desk incident put roughly 66,000 users at phishing risk.

Deletion Assurances Were Never Enforced

When Trezor first disclosed the leak last month, it pointed to a 90-day data retention policy that its partners were supposed to follow, arguing that old user data had been purged and the damage limited. That policy, the company now says, was never actually enforced — the data was never deleted from ShipMonk's systems. In a post on its official X account, Trezor apologized to affected customers, saying it is “terribly sorry” and that it takes the matter seriously. The company claims that throughout its entire relationship with ShipMonk it repeatedly received written assurances confirming deletion, in line with its contract and data policy, and therefore had “no reason to expect” further leaks. ShipMonk first alerted Trezor to the incident on August 10, describing a leak covering the most recent 90 days of orders; on September 2 it revised that scope back to 2019–2021. Trezor said its understanding is that cooperation from those earlier years was overlooked when the original scope was established. The company says it is too early to decide how it will respond to ShipMonk's actions, but it is arranging an additional audit of the mailing partner. It is also working to roll out anonymous delivery for orders so buyers can better protect their personal information. Notably, Trezor did not proactively brief media outlets this time, saying its priority was reaching the people actually affected. The episode illustrates a vendor-risk problem that extends well beyond crypto — the 2024 CrowdStrike outage showed how a single supplier failure can ripple across millions of endpoints — and it may push privacy-minded users toward tools from zero-knowledge privacy layers to anonymous shipping. Readers tracking the market in real time can follow live spot and futures prices on Gate.

Trezor apologizedhttps://x.com/Trezor/status/2095807665603584085?s=20

The load-bearing document here is Trezor's own disclosure, which states in writing that the company received repeated deletion confirmations that turned out not to reflect reality. Our reading: this is a supply-chain data-governance failure, not a cryptographic one — no private key was touched, and a hardware device remains the safest way to hold Bitcoin (BTC). But leaked addresses and phone numbers are precisely the raw material for convincing phishing. The test now is execution: the promised audit of ShipMonk and the anonymous-delivery rollout will show whether Trezor treats vendor oversight as a security function rather than a logistics detail. Affected users should never enter a wallet backup on any website or share it with anyone.