Trezor customer data exposed

[ryzaadit]

Well, this sounds simple in theory, but I dont think its possible in the real world.  Trezor (operated by parent company SatoshiLabs) is headquartered in Prague, Czech Republic.  DHL and all major couriers in EU are legally bound by strict KYC and anti-money laundering regulations which require real recipient details - especially for international shipping.

Yes, under The European Union (ICS2 / ENS 2.0).


I think Hardware Wallet company should offer discreet shipping. How these shipping service handle your package ?
- Plain package
- Remove any information are in the package i.e: company name or return address
- Some other factors are really matter in the privacy content.

These shipping offers are goods cause offer some anonymity and do not reveal some package information, content & identity. Some of big mechant right now already offering these shiping offers, for example: BigCommerce, Shopify, WooCommerce.

If the customer chooses this option, Trezor or other hardware wallet companies should deleted or at least stored their lock information customer data with encryption by using AES-256 after the package is receive.

[1] https://www.shiphero.com/blog/what-is-discreet-shipping
[2] https://www.easyship.com/blog/the-ultimate-guide-for-discreet-shipping

[X-ray]

~
Trezor did this one wrong, there is no need to keep data after a successful delivery of their devices, once the delivery is successful they should just wipe the data, this is also a way of keep decentralisation functional.

A third-party shipping provider was actually responsible for the leak, not the manufacturer itself.  So I would not put the blame entirely on the Trezor.  And yes, they may have handled it better and may very well do so next time - but that is not a guarantee that a situation like this wont happen again.

I wouldn't expect much from a third party shipping provider in regard of data keeping, their system most of the time are sloppily created.

The 90 day data retention policy is from Trezor's own intiative as far as I know, if the retention period were shorter, maybe they could've negotiated for an even shorter data retention from their shipping partner as well.

The GDPR law itself only tell companies to keep data no longer than necessary, 90 days is pretty long time for a shipping log, they could've made it shorter especially since this breach covers EU customer which is very close to where the hardware shipped from.

They are currently working on anonymous delivery option but honestly, I would've expected them to create such thing from a long time ago.

Trezor manufactured hardware wallet, but their business is also very close to their customer's privacy which should make them self conscious to trim on all those logs and retention policy.

[Wind_FURY]

Thankfully I searched for similar topic because I was about to create mine, right on time OP.

It's really not a great year for hardware wallet just like how CZ put this, only difference is he used month and not year, this is 2026 and whatever is happening right now will never be forgotten, 2026 is already marked.



Trezor did this one wrong, there is no need to keep data after a successful delivery of their devices, once the delivery is successful they should just wipe the data, this is also a way of keep decentralisation functional.

He probably just needs to shut up. Binance has also experienced hacks, exploits, and data breaches which exposed user information. It's very comical for one of the largest crypto services.

Plus the data breach in Trezor's user information was the shipping provider's fault, NOT Trezor.

[Lucius]

Trezor is a very good wallet, and I can recommend it, but the probelm that I have with these hardware companies is how they are dealing with customers data. Buying the wallet directly from the company can mean not having privacy.

If home addresses of people are known to the bad people, sending phishing letters to them will be common. Also phishing emails will be common.
~snip~

It is possible to buy directly from the manufacturer and still maintain privacy. The thing is so simple that I don't understand why people even order such things in their own name and address. All you need to do is arrange a PO Box and choose Bitcoin as payment.

From personal experience, I can say that Trezor supports this method of delivery, and so do many other manufacturers.

[philipma1957]

A wrench attack is very possible in this case. With the amount of personal information that has been breached, it is enough for a physical coercion with the user which in some countries it is actually on the rise. The good news is that their seed phrase and private keys are safe and no one will have access to their wallet with this information unless they fall for phishing emails, SMS or calls.

No matter how safe your keys are, you're likely to give out when you're attacked. The attackers are usually merciless and you'll have to choose between your life or the keys. I'm not a seer but I can tell what your choice would be in such situation. The best they can do is to review personal details information needed for delivery and make it secretly as possible.

With the quick response from Trezor to contact all affected users through a separate email, it shows how concerned they are and taking quick action to minimize any possible retaliation to their customers through the breach. The amount of personal information required from this self custody is much, it should be minimized. Hopefully with this breach, they can fast track their plan to introduce anonymous delivery intended for September 2026.

I respect their transparency tbh. They can conceal the incident and pretend like nothing happen but they choose to make it public, offer apology and reveal how they are working to minimise the future occurrence.

Regardless, if we keep having incidents like this with hardware wallets, people might begin to lose interest in using them.

If you use a passphrase you are fine.
You can open the trezor give them the standard wallet. And a passphrase wallet

While the big passphrase wallet is guarded and does not show up.

One must realize that having a few btc in a wallet is always a risk and very much like have a bag of cash under your bed.

[aoluain]

Ah FFS - looks like the weakest link in the chain got compromised - the fuck1n shipper.

I have a couple of Trezor's and the last time I bought one was about 4 years ago, I'm guessing
but hoping the 11k+ addresses are more recent than that?

Really sorry for all who end up compromised. This kickstarts everyone into examining their
security setup.

If you use a passphrase you are fine.
You can open the trezor give them the standard wallet. And a passphrase wallet

While the big passphrase wallet is guarded and does not show up.

One must realize that having a few btc in a wallet is always a risk and very much like have a bag of cash under your bed.

Thats sound advice and should be a default for everyone to use. If anyone gets compromised
hope and pray the scumbags arent clued into the hidden wallet.

[Mitchell]

[...]
I have a couple of Trezor's and the last time I bought one was about 4 years ago, I'm guessing
but hoping the 11k+ addresses are more recent than that?
[...]

Yes, most people affected are from recent orders (US, UK, Sweden, Colombia, Brazil, Italy, and Portugal between 10th of May and 8th of August 2026). However:

> We are sorry. According to our newest findings, the 1,947 customers whose exposure was limited only to name, city and email address (without the shipping address) may include older orders. We are verifying the exact timeframe with ShipMonk and will update this answer as soon as we have confirmation. If you received our notification email from help@trezor.io, your details were among those exposed, and we are sorry that this happened.

So your best bet is to check if you've received an email.

[aoluain]

[...]
I have a couple of Trezor's and the last time I bought one was about 4 years ago, I'm guessing
but hoping the 11k+ addresses are more recent than that?
[...]

Yes, most people affected are from recent orders (US, UK, Sweden, Colombia, Brazil, Italy, and Portugal between 10th of May and 8th of August 2026). However:

> We are sorry. According to our newest findings, the 1,947 customers whose exposure was limited only to name, city and email address (without the shipping address) may include older orders. We are verifying the exact timeframe with ShipMonk and will update this answer as soon as we have confirmation. If you received our notification email from help@trezor.io, your details were among those exposed, and we are sorry that this happened.

So your best bet is to check if you've received an email.

No emails Trezor related official or scam ATM - thankfully

[Zaguru12]

It is possible to buy directly from the manufacturer and still maintain privacy. The thing is so simple that I don't understand why people even order such things in their own name and address. All you need to do is arrange a PO Box and choose Bitcoin as payment.

From personal experience, I can say that Trezor supports this method of delivery, and so do many other manufacturers.

Aside this I think I have read multiple times before this incident about why it’s actually a bad idea to use your real details to actually purchase bitcoin there are options or tips to avoid that

1. Use a PO BOX or a company name to as address
2. Use a burner phone number and if any incidents happens you throw away the sim
3. Use burner email to actually buy from them but the only left off here is in case of important Information you wouldn’t get the message through mail.