Trezor Breach Grows by 67,000 US Records After ShipMonk Data Wasn’t Deleted

Hardware wallet maker Trezor said Friday, September 4, that a data breach it first disclosed in August is significantly larger than reported: another 67,000 US customers had names, emails, phone numbers, shipping addresses and order numbers exposed. The company blamed its third-party fulfillment partner, ShipMonk, saying the firm never actually deleted customer records despite repeated written assurances that it had.

What Three Outlets Confirm

Bitcoin Magazine, Protos and The Block all report the same core details: the newly identified 67,000 records cover orders placed between November 2019 and August 2021, and the leaked fields match across all three accounts. That level of agreement on the scope and dates makes this part of the story solid, not single-sourced.

Two of the three outlets also quote the same line from Trezor’s statement: “Throughout our entire relationship with ShipMonk, we repeatedly requested and received written assurance confirming the deletion of the data, in line with our contract, data policy, and past communications.”

Where the Sources Split: 11,742 or 13,689?

Here the reporting diverges in a way worth flagging rather than smoothing over. Bitcoin Magazine puts the original August disclosure at 11,742 customers across the US, UK, Sweden, Colombia, Brazil, Italy and Portugal. Protos instead cites 13,689 customers as the initial figure, framing today’s update as pushing the total past 80,000.

Those two counts cannot both be the same original number, and neither report cross-checks the other’s figure. Until Trezor publishes a single reconciled total, readers should treat the “over 80,000” combined tally as an aggregated snapshot built from differing baseline numbers, not a confirmed single-source figure.

Bitcoin Magazine additionally reports that 1,947 customers had names, cities and emails exposed in a separate slice of the leak. That detail appears in only one of the three reports reviewed here, so it should be read as unconfirmed by the others rather than as settled fact.

The ShipMonk Timeline, As Trezor Describes It

According to Trezor’s account, relayed by Protos, ShipMonk first told the company on August 10 about a breach it believed was limited to the prior 90 days of orders, consistent with Trezor’s stated data-retention policy. On September 2, ShipMonk came back and said the exposure actually stretched to records from 2019 and 2021.

Trezor said it had “no reason to expect” the scope to widen, given ShipMonk’s earlier written confirmations. In its own words to Protos: “Our understanding is that our cooperation from those years was overlooked when the original scope was established.”

Trezor also told Protos it’s “terribly sorry to everyone affected” and is working to introduce anonymous delivery for orders, along with a separate audit of ShipMonk’s systems. The company said it’s too early to say what action, if any, it will take against its shipping partner over the mishandled deletion.

Why the Discrepancy Matters for Trezor Customers

Leaked names, addresses and order numbers tied to a known hardware wallet buyer list are useful to attackers running phishing or physical-targeting scams against crypto holders. Anyone who ordered a Trezor device between November 2019 and August 2021 falls inside the newly confirmed exposure window, regardless of which initial count Trezor eventually settles on. A reconciled, single official figure from Trezor, rather than two competing counts circulating in the press, would close the gap left by this week’s reporting.

Sources

• bitcoinmagazine.com
• protos.com
• theblock.co