Trezor customers hit with phishing calls and letters after shipping-partner breach
Roughly 67,000 more customers of SatoshiLabs, the maker of hardware crypto-wallet Trezor, are at heightened risk of phishing attacks after their names, email addresses, phone numbers, and shipping addresses were exposed.
“The leaked information could be used for scam emails, fraudulent calls or letters, and could potentially expose affected individuals to physical security risks,” the Czech-based company confirmed in an update on the August 2026 data breach at ShipMonk, the firm that ships Trezor wallets on behalf of the wallet maker.
A breach at the shipping partner
According to the initial notice published by the Trezor maker on August 13, attackers gained access to ShipMonk’s systems that contained customer data. (ShipMonk later told customers that its breach was due to attackers exploiting an SQLi zero-day in Metabase’s Cloud SaaS platform.)
Despite SatoshiLabs requiring its shipping parties to delete or anonymize customer data after 90 days, ShipMonk apparently failed to do that for orders delivered to the US, UK, Sweden, Colombia, Brazil, Italy, and Portugal between May 10 and August 8, 2026, affecting 3,889 customers.
In last week’s update, SatoshiLabs confirmed that during the same breach, the attackers also got their hands on full shipping data of approximately 67,000 additional US-based customers, who placed their order between November 2019 and August 2021.
“Throughout our entire relationship with ShipMonk, we repeatedly requested and received written assurance confirming the deletion of the data, in line with our contract, data policy, and past communications. We are very disappointed that, despite receiving this confirmation, the data was not deleted in their systems,” SatoshiLabs reiterated.
Damage control and next steps
After each discovery, the company sent out emails to affected customers, warning them to be on the lookout for scam attempts.
The crypto-wallet maker confirmed that its systems were not compromised and that the customers’ devices are secure.
The question of whether SatoshiLabs’ partnership with ShipMonk will continue remains unanswered for the time being, but the company has stated that it’s working on providing the option for anonymous delivery – “dedicated checkout, locker pickup, neutral packaging, generic sender details, and automatic deletion of shipping identifiers after delivery” – as soon as possible.
In the meantime, customers who want to minimize the possibility of anyone discovering they bought a Trezor crypto-wallet should use an anonymous email address when ordering, pay with cryptocurrency or use a disposable digital card for online purchases, and use a P.O. Box for delivery.
The risk of physical attacks
On Reddit, several customers flagged receiving phishing calls and QR phishing delivered via physical letter:
The QR phishing letter (Source: Aim-AsphaltMan)
“This is the first time since Trezor was founded in 2013 that we have experienced a breach that exposed customer phone numbers and shipping addresses. We absolutely understand how serious this is and the potential risks it poses to our customers and are deeply sorry to those affected,” the company acknowledged.
According to blockchain analytics company Chainalysis, violent attacks targeting crypto holders have surged in recent years.
“As crypto adoption has grown, so has criminal awareness that a single individual might hold millions of dollars accessible via a smartphone or hardware wallet,” they recently noted.
“We estimate that violent criminals have successfully extracted more than $30 million from holders so far this year. If this pattern continues through H2, then 2026 will become the single-worst year for violent crypto attacks on record, surpassing 2025’s total of $58 million.”
In general, it’s advised that users don’t disclose their crypto holdings publicly, and use decoy/duress wallets, hidden wallets with passphrases, and multi-signature authorization setups.
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!