A Vendor Leak Exposed 81,000 Trezor Wallet Buyers

PRAGUE — The safest way to hold bitcoin is to keep the keys on a device only you control. It does nothing to protect the list of people who bought the device. Trezor, the Czech hardware-wallet maker, said on September 4 that a breach at its shipping provider, ShipMonk, exposed personal data for roughly 81,000 of its customers — and that its own systems were never touched.

What leaked, and when

The numbers grew in two steps. When Trezor first disclosed the incident on August 13, it said about 14,000 customers were affected — 11,742 with names, emails, phone numbers and shipping addresses exposed, and another 1,947 with names, cities and emails. On September 2, ShipMonk told the company the breach was far larger: roughly 67,000 more U.S. customers, from orders placed between November 2019 and August 2021, with names, emails, phone numbers, shipping addresses and order numbers in the leaked records.

Trezor was pointed about the failure. It said it had repeatedly asked ShipMonk to delete the old order data and received written assurances, in line with its contract, that the data had been removed. “We are very disappointed that, despite receiving this confirmation, the data was not deleted in their systems,” the company said. Its hardware wallets, it stressed, remain secure, and its own infrastructure was not compromised.

The threat is not cryptographic

Nothing here breaks bitcoin’s security model. No private keys, seed phrases or funds were exposed, and a Trezor device does not become easier to crack because a shipping vendor lost a spreadsheet. The danger is more mundane and, in some ways, more dangerous: a list of names matched to home addresses and phone numbers, all belonging to people known to own a bitcoin hardware wallet. That is a targeting list for phishing, impersonation and, at the extreme, physical coercion.

A list of people known to own a bitcoin wallet, matched to their home addresses, is a targeting list.

Trezor emailed affected customers and warned them to expect scam emails, fraudulent calls and letters, and to be alert to physical-security risks. The company’s advice reduces to a discipline every bitcoiner should already practice: no legitimate wallet maker will ever ask for your recovery seed, by email, phone, letter or app.

The Ledger precedent

The industry has run this experiment before, and the results linger. In 2020 a breach at rival Ledger exposed data for more than 270,000 customers; names, emails, phone numbers and, in many cases, home addresses were later dumped on a hacking forum. Years on, Ledger customers still report scam phone calls and physical letters — some demanding seed phrases, some threatening — built from that same leaked list. A customer database, once loose, does not expire.

The lesson is not that hardware wallets failed; they did their job. It is that self-custody is only as private as the weakest company that handled your order. Bitcoin lets you remove the bank from your savings. It does not, by itself, remove the courier, the fulfilment firm and the marketing vendor from your address. The privacy-minded answer — a separate shipping address, a burner email, buying in person — is friction most buyers skip, right up until a list like this one goes missing.

Why it matters: owning your keys protects your coins, not your identity — and the trail of who bought a wallet, and where they live, is a soft target no amount of self-custody can secure.