On September 2, a logistics company called ShipMonk called Trezor back with a correction. The breach it had disclosed in August was larger than either party had told customers. Roughly 67,000 additional U.S. buyers were in the exposed records, on top of the 13,689 already notified, and the files reached back to orders placed in November 2019.
Trezor's devices were never touched. Its own systems were never touched. The company confirmed both while telling affected customers to watch for scam calls, fraudulent letters and physical security risks, which is a sentence worth reading twice.
What Was Actually in the Files
The exposed records carry names, email addresses, phone numbers, shipping addresses and order numbers, covering purchases placed between November 2019 and August 2021. A fair number of the people now on that list have since moved house, changed jobs and forgotten they ever bought the thing.
None of that is a crypto secret. All of it, taken together, is a wealth signal with a street address attached. A shipping record for a hardware wallet is a statement that this specific person, at this specific door, was holding enough crypto in 2020 to justify buying a device to protect it.
The Control That Turned Out Not to Be One
Trezor's contract required fulfillment partners to delete or anonymise order data 90 days after delivery. The company says it asked ShipMonk repeatedly to delete the records and received written confirmation that this had been done, in line with the contract and the data policy. Five to seven years later, the data was still sitting in ShipMonk's systems.
A promise to delete is the only security control a customer can never audit. Encryption can be tested, access logs can be reviewed, and reserves can be proved against a published attestation. Deletion produces no artifact, and the absence of evidence is exactly what a successful deletion looks like, which is also exactly what a forgotten database looks like.
Trezor did the reasonable thing here. It wrote the clause, it chased the vendor, it collected the confirmation. The confirmation was worthless and there was no mechanism on earth by which it could have known that before the breach.
Why This One Ages Badly
The exposure has no expiry date
A leaked password is a five-minute problem. A leaked home address is permanent. You cannot rotate where you live, and the people who bought a device in 2020 have no way to remove themselves from a file that has already been copied.
The attack it enables is physical
The precedent is well documented. A 2020 Ledger breach exposed more than 270,000 customers, with names, phone numbers and in some cases home addresses later published on a hacking forum. Five years on, those customers were still receiving physical letters asking for their seed phrase, printed and mailed, dressed up as a security notice from the manufacturer.
That is the half-life to plan around, and it runs in years rather than news cycles.
What Reduces Your Exposure From Here
- Treat every unsolicited contact referencing your device as hostile. Order numbers in the leak let an attacker quote your purchase back to you, which is the single most convincing thing a scammer can do.
- Never type a seed phrase into anything. No firmware update, validation page, support agent or mailed letter has ever legitimately needed it, and none ever will.
- Add a passphrase. A seed plus a passphrase means a coerced or stolen recovery sheet does not by itself surrender the balance.
- Split your delivery address from your storage reality. Future hardware purchases can go to a locker, an office or a forwarding service, and a dedicated email address keeps the next vendor leak from joining up with the last one.
- Assume the lists get merged. Any single leak is survivable on its own, and the danger lies in the join, where a wallet vendor's shipping file cross-referenced against an old exchange KYC dump and a domain registration produces a name, an address and an estimated balance.
The LeveX Take
The industry grades incidents like this on whether funds moved. By that standard nothing happened here, and that scoring is precisely why it keeps happening. The real output of the last decade of vendor breaches is a slowly compounding index of people who probably hold crypto, complete with where they sleep, and every new leak makes every old leak more valuable.
Self-custody removes counterparty risk and replaces it with a supply chain you do not control and cannot inspect. Manufacturer, reseller, fulfillment partner, courier. Cold storage protects the key beautifully and has nothing to say about the invoice that shipped with it. Anyone who has been in this long enough to remember the 2020 leak knows the follow-on damage arrives quietly, in an envelope, years after the story stops trending.
Which is why the verification question matters more than the assurance question. Trezor was told the data was gone and had no way to check. The equivalent problem in custody is whether an exchange holds what it claims to hold, and that one has an actual answer: LeveX publishes 1:1 Proof of Reserves through a Merkle tree that any user can verify against their own balance, rather than a written confirmation that everything is fine. Proof of Reserves does nothing about a shipping database, and it is worth being clear about that. It is the demonstration that the checkable version of a trust claim exists, and that vendors who avoid building one are choosing to be believed instead of audited. The rest of LeveX's security architecture is documented on the same principle.
The Question Worth Asking Every Vendor
Where does my order data go, who holds it after delivery, and how would anyone know if it were still there? Nobody asks this before buying a $150 device, and the answer determines a security exposure that outlasts the device by years.
One near-term thing to watch: Trezor has emailed every affected customer, which means a legitimate breach notification is now circulating. Expect imitations of it within weeks, because that is what happened after 2020, and the imitations will be good.
Traders who would rather keep working capital somewhere with a published, checkable reserve position can trade ETH on spot or run ETHUSDT perpetuals on LeveX, and the Crypto in a Minute series covers the custody trade-offs in more detail than a breach notice ever will.