Crypto wallet maker Trezor confirms 13,000 customers' details exposed in logistics breach

Even if your hardware is secure, quantum-ready, encrypted, and future-proof, no one is immune to a supplier letting the side down

Cryptocurrency hardware wallet maker Trezor has confirmed that a breach at one of its shipping partners exposed the personal data of more than 13,000 customers.

The company's initial findings suggested the breach was limited to orders placed in certain countries during the previous 90 days. New information indicates that earlier orders may also be affected.

The breach exposed the names, email addresses, phone numbers, and shipping addresses of 11,742 customers in the US, UK, Sweden, Colombia, Brazil, Italy, and Portugal who ordered Trezor products between May 10 and August 8.

REG AD

An additional 1,947 customers had their names, home cities, and email addresses exposed. Some members of this group may have placed their orders before May 10.

REG AD

"We are verifying this information and the timeframe with ShipMonk," said Trezor.

ShipMonk is Trezor's logistics partner. It stores and ships products on the company's behalf and collects the information needed to fulfill orders.

ShipMonk is subject to Trezor's 90-day retention policy, which requires partners to delete or anonymize customer data within 90 days of collecting it for an order.

ShipMonk did not immediately respond to a request for comment.

Trezor markets itself as a purveyor of secure, offline, hardware-based cryptocurrency wallets. With its products, it aims to shield customers from cyberattacks and malicious apps.

While it assured customers that its own systems and devices remain secure, Trezor warned that "affected customers could experience an increase in phishing attempts."

The exposed details could help criminals craft convincing phishing attempts impersonating banks, crypto exchanges, or Trezor itself.

The company said it contacted affected customers directly and advised them to check any communications against information published through its official channels.

REG AD

"Never enter your wallet backup on a website or share it with anyone," Trezor said in an apologetic advisory.

"This is the first time since Trezor was founded in 2013 that we have experienced a breach that exposed customer phone numbers and shipping addresses.

"We absolutely understand how serious this is and the potential risks it poses to our customers and are deeply sorry to those affected."

Trezor said in a supplementary social media post, separate from the advisory, that its "top priority" project at the moment is to establish an "Anonymous Delivery" option for customers.

The service will allow buyers to complete checkout without linking their home address or real-world identity to an order.

Customers using Anonymous Delivery will go through a dedicated checkout, use a nickname or label ID in place of a real name, and have their product shipped to an automated delivery locker instead of their home. 

The delivery will also come in unbranded packaging with a generic sender label. The carrier will only use email or SMS to send a PIN for the locker.

Trezor said the service is gearing up for a September launch in the EU and by the end of the year in the US.

REG AD

Alas, that didn't stop Cake Wallet, a rival crypto wallet, from poking fun at Trezor.

"Another rough day for self custody," it Xeeted, before suggesting crypto holders instead use an old smartphone with Cake Wallet installed because "there is no order, no shipping address, or customer data tied to the purchase." ®