It took two business days for the story to get worse. On September 2, ShipMonk told Trezor the breach was larger than reported. By September 4, the running total hit roughly 80,700 customers โ an additional 67,000 U.S. users who ordered hardware wallets between November 2019 and August 2021 had their full contact records exposed [[2]][[20]]. Names. Email addresses. Phone numbers. Physical shipping addresses. Order specifics. The single most dangerous dataset a hardware wallet vendor can lose is not a private key โ it is the proof that a specific person at a specific door owns one. [[14]]
Trezor's own systems were never compromised. No device was touched. No seed phrase was extracted. None of that matters. The attackers now hold a map of verified crypto wallet owners, and the industry's first quarter loss data says exactly how they will use it: Hacken reported that social engineering and phishing drove $306 million of the $482 million total crypto losses in Q1 2026 [[6]]. The algorithm priced the ape before the crowd did. The phishing campaign has not started yet. That is the window you should be watching.
The August disclosure was already bad. The September correction is worse.
Let me reset the timeline, because the sequencing is where the real story lives. On August 13, Trezor disclosed that ShipMonk โ its shipping and fulfillment partner โ had suffered a data breach. Initial figures: 11,742 customers with full exposure, another 1,947 with partial exposure, across the U.S., UK, Sweden, Colombia, Brazil, Italy, and Portugal [[13]][[15]]. Trezor leaned on its 90-day data deletion policy as the mitigation story. Old orders were purged, they claimed. Partners followed the same terms. The blast radius looked contained at roughly 13,689 people [[15]].
Then ShipMonk went back and checked the archive. On September 2, they found records that should have been deleted โ and were not [[20]][[5]]. Trezor said it had received written assurances from ShipMonk that older data would be purged. Those assurances were structurally false [[17]]. The newly exposed cohort placed orders between November 2019 and August 2021. Some of that information is nearly seven years old [[20]]. The 90-day policy was never the defense it appeared to be; it was a paper promise stored in a third-party's retention system with no enforcement mechanism.
This is the first time in Trezor's history โ the company was founded in 2013 โ that a breach exposed customer phone numbers and shipping addresses [[8]][[14]]. The January 2024 support portal incident touched roughly 66,000 users but did not expose physical addresses [[12]]. The April 2022 incident exposed data on more than 106,000 customers [[16]]. Each breach layers on the previous one. The attack surface is not Trezor's firmware. It is not the secure element. It is the logistics spine โ every warehouse, every fulfillment node, every analytics dashboard that touches order data.
The breach vector matters more than the headline.
ShipMonk's exposure was traced to a SQL-injection vulnerability in its Metabase analytics platform, first reported around August 6, 2026 [[17]]. This is the detail the market glosses over. A SQL injection in a business-intelligence dashboard does not require nation-state resources. It does not require a zero-day. It requires an unpatched analytics instance and a list of database queries. The attacker did not break the encryption on Trezor's devices. They broke the trust boundary between Trezor and a logistics vendor that was never designed to be a security perimeter.
Based on my experience auditing supply-chain trust boundaries across DeFi and custody infrastructure, I can tell you the failure pattern here is textbook. The vendor had access to a data class it never needed to retain. ShipMonk held seven years of order records for a hardware wallet manufacturer. That data is not needed for logistics beyond the delivery window. It is needed for nothing except a database that was never purged. The retention policy is the vulnerability. The SQL injection was just the trigger. [[17]]
The downstream risk compounds because Trezor customers are identifiable as cryptocurrency hardware wallet users. A name plus a home address plus a phone number identifies a specific person at a specific door as someone who very likely holds digital assets [[14]]. This is not spam-list fraud. This is target selection. The leaked data set is arguably the most dangerous kind because it converts a cold-storage product โ designed to remove private keys from networked exposure โ into a honeypot for social engineering [[14]].
Chainalysis put the amount stolen through violent attacks at more than $30 million in the first half of 2026, on pace to surpass 2025's full-year total of roughly $58 million [[15]][[19]]. That number is not a coincidence. Physical address exposure of crypto holders is now funding a documented pattern of home invasions. A French couple was targeted in three home invasions in less than a month this summer after their address leaked onto the dark web [[19]]. The market treats these as separate stories. They are the same story.
The competitive context makes this systemic, not idiosyncratic.
Ledger's payment processor Global-e leaked customer order data in January 2026. Within days, attackers sent phishing emails announcing a fake Ledger and Trezor merger, personalized with the leaked order details [[14]]. Vendors keep proving to be the weakest link in this chain. When your competitor's logistics leak produces phishing emails that impersonate your own company, the entire hardware wallet sector has a supply-chain security problem that no single vendor's firmware can solve.
The market response has been measured but telling. Around the Coldcard breach, roughly 233,000 BTC left long-term holder wallets โ worth approximately $15 billion โ with a meaningful portion moving to multi-signature setups after watching the exploit unfold [[15]]. The flight to multi-sig is not a vote against hardware wallets. It is a vote against single-vendor trust. Structure is not a cage; it is a launchpad. The structure here is the entire custody stack โ and a logistics database just cracked its foundation.
Trezor has responded by accelerating its rollout of an Anonymous Delivery option, designed to decouple customer identities from shipping records at the point of purchase [[17]]. This is the right direction and the wrong timeline. Anonymous delivery solves the problem for future orders. It does nothing for the 67,000 customers whose records ShipMonk failed to purge. The remediation is not a product feature; it is a data retention audit.
What the market is not pricing.
The contrarian angle here is not the phishing risk โ that is now consensus. The unreported angle is the trust differential between hardware wallet vendors and their own supply chains. Every major vendor in this sector now has a disclosed logistics or payment processor breach. Ledger had Global-e. Trezor had ShipMonk. The narrative that hardware wallets are the "cold storage" answer to exchange risk is colliding with the reality that the supply chain is a warm attack surface.
Value is a consensus, not a contract. The market consensus on hardware wallet security is built on the assumption that the device is the security perimeter. The ShipMonk breach โ and the Global-e breach before it โ falsifies that assumption. The perimeter extends to every vendor that touches customer data. The 90-day retention policy is only as strong as the third party's willingness to enforce it. Trezor received written assurances. Those assurances were not honored. Trust in a supply chain is a liability disguised as an operational convenience. [[17]]
There is also a structural imbalance worth tracking. The 67,000 newly exposed customers are concentrated in the United States โ orders placed between 2019 and 2021. That is a compliance trigger, not just a security incident. U.S. state-level regulators have shown a willingness to open investigations into data breaches affecting state residents. If any state attorney general opens an inquiry, the cost curve shifts from notification fees to legal defense. The GDPR angle is secondary; the U.S. state-level exposure is the primary regulatory risk vector [[15]][[19]].
The watch list.
I am tracking four signals over the next 60 days. First, phishing case volume: if more than ten credible attack reports surface using ShipMonk data, user attrition accelerates. Second, Trezor's official response: any supplemental disclosure beyond its September 4 statement signals the problem is still expanding. Third, peer incidents: if more than three hardware wallet vendors report supply-chain breaches, the industry shifts from incident response to standard-setting. Fourth, U.S. state regulatory action: any state-level investigation launch changes the cost calculus entirely.
The industry's real test is not whether Trezor's firmware is secure โ it demonstrably is. The test is whether hardware wallet vendors can build a supply chain that treats customer data like the security asset it is. The 90-day deletion policy was a good start and a failed execution. Anonymous delivery is a good next step and an incomplete answer. The algorithm will price this event when the first successful phishing campaign drains a wallet. Do not wait for that data point.
Liquidity didn't move on this news. But trust did. And in hardware wallets, trust is the only collateral that matters. The next disclosure will not be a logistics breach. It will be a seed-phrase theft that traces back to a personalized phishing email referencing a 2020 order. That email has already been composed. It is waiting in a queue. The question is whether you recognize it before your seed phrase does. [[6]]