Trezor customer data exposed

[ryzaadit]

Well, this sounds simple in theory, but I dont think its possible in the real world.  Trezor (operated by parent company SatoshiLabs) is headquartered in Prague, Czech Republic.  DHL and all major couriers in EU are legally bound by strict KYC and anti-money laundering regulations which require real recipient details - especially for international shipping.

Yes, under The European Union (ICS2 / ENS 2.0).


I think Hardware Wallet company should offer discreet shipping. How these shipping service handle your package ?
- Plain package
- Remove any information are in the package i.e: company name or return address
- Some other factors are really matter in the privacy content.

These shipping offers are goods cause offer some anonymity and do not reveal some package information, content & identity. Some of big mechant right now already offering these shiping offers, for example: BigCommerce, Shopify, WooCommerce.

If the customer chooses this option, Trezor or other hardware wallet companies should deleted or at least stored their lock information customer data with encryption by using AES-256 after the package is receive.

[1] https://www.shiphero.com/blog/what-is-discreet-shipping
[2] https://www.easyship.com/blog/the-ultimate-guide-for-discreet-shipping

[X-ray]

~
Trezor did this one wrong, there is no need to keep data after a successful delivery of their devices, once the delivery is successful they should just wipe the data, this is also a way of keep decentralisation functional.

A third-party shipping provider was actually responsible for the leak, not the manufacturer itself.  So I would not put the blame entirely on the Trezor.  And yes, they may have handled it better and may very well do so next time - but that is not a guarantee that a situation like this wont happen again.

I wouldn't expect much from a third party shipping provider in regard of data keeping, their system most of the time are sloppily created.

The 90 day data retention policy is from Trezor's own intiative as far as I know, if the retention period were shorter, maybe they could've negotiated for an even shorter data retention from their shipping partner as well.

The GDPR law itself only tell companies to keep data no longer than necessary, 90 days is pretty long time for a shipping log, they could've made it shorter especially since this breach covers EU customer which is very close to where the hardware shipped from.

They are currently working on anonymous delivery option but honestly, I would've expected them to create such thing from a long time ago.

Trezor manufactured hardware wallet, but their business is also very close to their customer's privacy which should make them self conscious to trim on all those logs and retention policy.

[Wind_FURY]

Thankfully I searched for similar topic because I was about to create mine, right on time OP.

It's really not a great year for hardware wallet just like how CZ put this, only difference is he used month and not year, this is 2026 and whatever is happening right now will never be forgotten, 2026 is already marked.



Trezor did this one wrong, there is no need to keep data after a successful delivery of their devices, once the delivery is successful they should just wipe the data, this is also a way of keep decentralisation functional.

He probably just needs to shut up. Binance has also experienced hacks, exploits, and data breaches which exposed user information. It's very comical for one of the largest crypto services.

Plus the data breach in Trezor's user information was the shipping provider's fault, NOT Trezor.

[Lucius]

Trezor is a very good wallet, and I can recommend it, but the probelm that I have with these hardware companies is how they are dealing with customers data. Buying the wallet directly from the company can mean not having privacy.

If home addresses of people are known to the bad people, sending phishing letters to them will be common. Also phishing emails will be common.
~snip~

It is possible to buy directly from the manufacturer and still maintain privacy. The thing is so simple that I don't understand why people even order such things in their own name and address. All you need to do is arrange a PO Box and choose Bitcoin as payment.

From personal experience, I can say that Trezor supports this method of delivery, and so do many other manufacturers.

[philipma1957]

A wrench attack is very possible in this case. With the amount of personal information that has been breached, it is enough for a physical coercion with the user which in some countries it is actually on the rise. The good news is that their seed phrase and private keys are safe and no one will have access to their wallet with this information unless they fall for phishing emails, SMS or calls.

No matter how safe your keys are, you're likely to give out when you're attacked. The attackers are usually merciless and you'll have to choose between your life or the keys. I'm not a seer but I can tell what your choice would be in such situation. The best they can do is to review personal details information needed for delivery and make it secretly as possible.

With the quick response from Trezor to contact all affected users through a separate email, it shows how concerned they are and taking quick action to minimize any possible retaliation to their customers through the breach. The amount of personal information required from this self custody is much, it should be minimized. Hopefully with this breach, they can fast track their plan to introduce anonymous delivery intended for September 2026.

I respect their transparency tbh. They can conceal the incident and pretend like nothing happen but they choose to make it public, offer apology and reveal how they are working to minimise the future occurrence.

Regardless, if we keep having incidents like this with hardware wallets, people might begin to lose interest in using them.

If you use a passphrase you are fine.
You can open the trezor give them the standard wallet. And a passphrase wallet

While the big passphrase wallet is guarded and does not show up.

One must realize that having a few btc in a wallet is always a risk and very much like have a bag of cash under your bed.

[aoluain]

Ah FFS - looks like the weakest link in the chain got compromised - the fuck1n shipper.

I have a couple of Trezor's and the last time I bought one was about 4 years ago, I'm guessing
but hoping the 11k+ addresses are more recent than that?

Really sorry for all who end up compromised. This kickstarts everyone into examining their
security setup.

If you use a passphrase you are fine.
You can open the trezor give them the standard wallet. And a passphrase wallet

While the big passphrase wallet is guarded and does not show up.

One must realize that having a few btc in a wallet is always a risk and very much like have a bag of cash under your bed.

Thats sound advice and should be a default for everyone to use. If anyone gets compromised
hope and pray the scumbags arent clued into the hidden wallet.

[Mitchell]

[...]
I have a couple of Trezor's and the last time I bought one was about 4 years ago, I'm guessing
but hoping the 11k+ addresses are more recent than that?
[...]

Yes, most people affected are from recent orders (US, UK, Sweden, Colombia, Brazil, Italy, and Portugal between 10th of May and 8th of August 2026). However:

> We are sorry. According to our newest findings, the 1,947 customers whose exposure was limited only to name, city and email address (without the shipping address) may include older orders. We are verifying the exact timeframe with ShipMonk and will update this answer as soon as we have confirmation. If you received our notification email from help@trezor.io, your details were among those exposed, and we are sorry that this happened.

So your best bet is to check if you've received an email.

[aoluain]

[...]
I have a couple of Trezor's and the last time I bought one was about 4 years ago, I'm guessing
but hoping the 11k+ addresses are more recent than that?
[...]

Yes, most people affected are from recent orders (US, UK, Sweden, Colombia, Brazil, Italy, and Portugal between 10th of May and 8th of August 2026). However:

> We are sorry. According to our newest findings, the 1,947 customers whose exposure was limited only to name, city and email address (without the shipping address) may include older orders. We are verifying the exact timeframe with ShipMonk and will update this answer as soon as we have confirmation. If you received our notification email from help@trezor.io, your details were among those exposed, and we are sorry that this happened.

So your best bet is to check if you've received an email.

No emails Trezor related official or scam ATM - thankfully

[Zaguru12]

It is possible to buy directly from the manufacturer and still maintain privacy. The thing is so simple that I don't understand why people even order such things in their own name and address. All you need to do is arrange a PO Box and choose Bitcoin as payment.

From personal experience, I can say that Trezor supports this method of delivery, and so do many other manufacturers.

Aside this I think I have read multiple times before this incident about why it’s actually a bad idea to use your real details to actually purchase bitcoin there are options or tips to avoid that

1. Use a PO BOX or a company name to as address
2. Use a burner phone number and if any incidents happens you throw away the sim
3. Use burner email to actually buy from them but the only left off here is in case of important Information you wouldn’t get the message through mail.

[Lucius]

If you use a passphrase you are fine.
You can open the trezor give them the standard wallet. And a passphrase wallet

While the big passphrase wallet is guarded and does not show up.

One must realize that having a few btc in a wallet is always a risk and very much like have a bag of cash under your bed.

If thieves physically attack someone in their house/apartment and are looking for cryptocurrencies, then it can be assumed that they know that it is possible to have hidden wallets. There are very convincing ways to get what they want, especially if they threaten to torture your family members or yourself.

Most people will give in very quickly, so in the end it's just a matter of time.

[Synchronice]

That's why probably it's better to buy a cheap used laptop, remove Bluetooth and Wi-Fi, never connect it to the internet ever, install a tails on a flash drive, put it on your computer and then generate a seed for your Bitcoin wallet. Everyone buys laptops, so even if the fact that you bought a laptop gets leaked, it's not a problem and you won't become a victim of scammers or an attack.

...OR you can just order a Trezor on another address using fake name?

Trezor is the real deal, I just love it. Incredibly convenient to use and it's been proven to have the most secure entropy.

Again, it's not entirely the company's fault (although as I already said they should have handled it better by using confidential-first delivery services, even if they are more expensive) and one could avoid it if with just a little more effort.

Again, that effort would be nowhere close to the laptop hassle you described.

Actually, Coldcard was considered the most secure by every logic but we saw what happened to it. It's hard to call secure to any hardware wallet right now because tomorrow might be another surprise.
By the way, how can you order a wallet on a fake address and name? When courier comes, what are you gonna do? How are you gonna get the parcel? If it goes to a fake address, you'll have to sit there and wait for the courier for countless working hours and if you order it on a fake name, courier might not leave the parcel on the address. Also what if someone from the fake address claims it?

[SensitiveEyes]

If you use a passphrase you are fine.
You can open the trezor give them the standard wallet. And a passphrase wallet

While the big passphrase wallet is guarded and does not show up.

One must realize that having a few btc in a wallet is always a risk and very much like have a bag of cash under your bed.

If thieves physically attack someone in their house/apartment and are looking for cryptocurrencies, then it can be assumed that they know that it is possible to have hidden wallets. There are very convincing ways to get what they want, especially if they threaten to torture your family members or yourself.

Most people will give in very quickly, so in the end it's just a matter of time.

In business reputations are everything so ShipMonk could go out of business because of the leak. 11,742 customer names, email addresses, phone numbers and shipping addresses were leaked. 1,947 customer names, cities and email addresses without shipping addresses were leaked.

If thieves broke in to steal crypto they will not blink when hurting people. They would not go through the trouble of breaking in unless they left with the crypto so who will accept being tortured or watching their family being tortured. They will hand over the crypto before they get hurt.

[sergiorus]

That's why probably it's better to buy a cheap used laptop, remove Bluetooth and Wi-Fi, never connect it to the internet ever, install a tails on a flash drive, put it on your computer and then generate a seed for your Bitcoin wallet. Everyone buys laptops, so even if the fact that you bought a laptop gets leaked, it's not a problem and you won't become a victim of scammers or an attack.

...OR you can just order a Trezor on another address using fake name?

Trezor is the real deal, I just love it. Incredibly convenient to use and it's been proven to have the most secure entropy.

Again, it's not entirely the company's fault (although as I already said they should have handled it better by using confidential-first delivery services, even if they are more expensive) and one could avoid it if with just a little more effort.

Again, that effort would be nowhere close to the laptop hassle you described.

~snip~
By the way, how can you order a wallet on a fake address and name? When courier comes, what are you gonna do? How are you gonna get the parcel? If it goes to a fake address, you'll have to sit there and wait for the courier for countless working hours and if you order it on a fake name, courier might not leave the parcel on the address. Also what if someone from the fake address claims it?

- PO Box
- Your workplace address

**IF** none of the above are for some reason applicable:

- Hotel where you stay for the day when the parcel arrives
- An apartment/AirBnb you rented just to receive the parcel

The two above seem like expensive options, however:

1. One can do it while traveling (one stone - two birds)
2. One can do it in some very cheap town not too far away
3. One may be rich enough and can't be bothered

[m2017]

Looks like the shipping provider Trezor uses (ShipMonk) had a data breach: https://trezor.io/blog/news/recent-customer-data-exposed-in-shipping-provider-incident

Ultimately, the fault lies with shipping provider, not Trezor. In my view, Trezor did its best to minimize the negative consequences of such a data leak (such as reducing the data retention period to 90 days), although this offers little consolation to those affected.

Trezor has also announced that they're working on an annonymous delivery option which should be ready by September for the EU, and year end for the U.S. Not sure about the rest of the world.

It raises doubts as to how this could actually be implemented in the current landscape. But let’s wait for the announcement; after all, Trezor wouldn’t make such claims unless they had a "workable" idea. I’m genuinely curious to see what they come up with and whether it could serve as a "starting point" for other manufacturers to adopt a similar approach.

But my main question is: how will local regulators react? Just imagine, parcels being sent between anonymous senders and recipients. It’s like Monero for the postal service. If I were a regulator, I’d want to ban the whole idea.

[aoluain]

Looks like the shipping provider Trezor uses (ShipMonk) had a data breach: https://trezor.io/blog/news/recent-customer-data-exposed-in-shipping-provider-incident

Ultimately, the fault lies with shipping provider, not Trezor. In my view, Trezor did its best to minimize the negative consequences of such a data leak (such as reducing the data retention period to 90 days), although this offers little consolation to those affected.

Trezor has also announced that they're working on an annonymous delivery option which should be ready by September for the EU, and year end for the U.S. Not sure about the rest of the world.

It raises doubts as to how this could actually be implemented in the current landscape. But let’s wait for the announcement; after all, Trezor wouldn’t make such claims unless they had a "workable" idea. I’m genuinely curious to see what they come up with and whether it could serve as a "starting point" for other manufacturers to adopt a similar approach.

But my main question is: how will local regulators react? Just imagine, parcels being sent between anonymous senders and recipients. It’s like Monero for the postal service. If I were a regulator, I’d want to ban the whole idea.

Is it just me or are others thinking that Trezor kind of (may have) slipped up here as well?

Trezor know they handle very sensitive information ^{their customers details}, wouldnt it be
reasonable to think that...

at the very least the shipper would have been instructed to not correlate the origin of the
packages^Trezor with the customer.

or

at the very most Trezor stipulate that all of the destination addresses be deleted from ShipMonk's
database after the items are delivered, or something to that effect.

It just seems like nobody thought ShipMonk retaining customers data was going to be an issue.