Hardware wallet provider Trezor has revealed that a data breach at its shipping partner exposed information belonging to an additional 67,000 US customers, significantly increasing the potential pool of users vulnerable to phishing and social-engineering attacks.
The newly identified customers placed orders between November 2019 and August 2021, according to Trezor. Although the company’s own systems were not breached, exposed customer information could give attackers enough details to create convincing impersonation attempts targeting cryptocurrency holders.
- An additional 67,000 US customers were identified as affected.
- Exposed information includes names, email addresses, shipping details and order information.
- The affected orders were processed through shipping provider ShipMonk.
- Trezor said its own systems and wallet security were not compromised.
- Attackers could use the leaked information to conduct targeted phishing and social-engineering campaigns.
Shipping Provider Breach Expands Trezor Exposure
Trezor disclosed the expanded impact in a Sept. 4 update, citing new information from its shipping provider, ShipMonk.
The affected customers had placed orders during a period stretching from November 2019 through August 2021. Their exposed records reportedly contained personal and purchase-related information, including their full name, email address, telephone number, delivery address and order details.
Trezor said ShipMonk had previously provided written assurances that the relevant customer information would be deleted. The company now says that the data remained in the provider’s systems.
The incident does not indicate that Trezor’s hardware wallets or internal systems were directly compromised. Instead, the risk stems from the availability of information that could help criminals identify people who own or have purchased Trezor devices.
Phishing Risk Is the Main Concern
The biggest threat for affected customers is not the immediate theft of wallet assets but targeted social engineering.
Attackers who know that an individual purchased a hardware wallet can potentially construct highly convincing messages pretending to come from Trezor. Such messages could claim that a wallet requires an urgent security update, that an account is at risk, or that a recovery process must be completed.
The ultimate objective in many such attacks is obtaining a victim’s seed phrase or private wallet credentials.
A hardware wallet can remain technically secure while its owner becomes the target of an effective impersonation campaign. For this reason, leaked customer information can become particularly valuable when it is associated with cryptocurrency ownership.
Trezor has emphasized that users should never disclose their recovery seed or enter it into websites, applications or forms prompted through unsolicited communications.
Number of Potentially Exposed Users Keeps Rising
The latest disclosure follows an earlier estimate from August, when Trezor said approximately 14,000 customers had been affected by the shipping-provider incident.
The newly identified 67,000 US users therefore represent a substantial expansion of the original estimate.
Trezor has also faced a separate customer-data exposure in the past. In January 2024, the company warned that approximately 66,000 users could face phishing risks after interacting with its customer-support system since December 2021.
The incidents demonstrate how information held outside a cryptocurrency company’s core infrastructure can still create security risks for users.
Crypto Users Remain a Prime Target for Social Engineering
Phishing and social engineering continue to be among the most effective ways criminals target cryptocurrency holders because these attacks can bypass sophisticated blockchain and smart-contract security measures.
Unlike a technical exploit, an attacker does not necessarily need to compromise a wallet, blockchain or exchange. Convincing a user to voluntarily reveal sensitive information or authorize a malicious transaction can be enough.
Research from blockchain security firm Hacken cited in the original report found that impersonation-based attacks accounted for a substantial share of crypto losses during the first quarter of the year.
Recent incidents have also demonstrated how expensive a single successful phishing campaign can become, with individual cryptocurrency investors losing hundreds of thousands of dollars after interacting with malicious transactions.
Trezor Customers Should Remain Vigilant
The expanded breach highlights the importance of treating unexpected communications involving hardware wallets with extreme caution.
Affected customers may receive messages containing legitimate personal information, such as their name, previous order details or shipping address. Such information can make fraudulent communications appear authentic.
However, possession of those details does not give an attacker legitimate access to a Trezor wallet.
The key security principle remains unchanged: never share a recovery seed phrase or private key with anyone, regardless of how convincing the request appears.
The incident also illustrates a broader challenge for cryptocurrency companies: protecting customers requires more than securing internal systems. Third-party logistics providers, support platforms and other service partners can hold information that becomes valuable to attackers long after an original transaction has taken place.
