A cascading series of third-party vendor failures has left tens of thousands of hardware crypto wallet customers exposed to phishing, scam calls, and even physical mail attacks.
Trezor's shipping partner ShipMonk suffered a breach in August 2026 that initially exposed names, email addresses, phone numbers, and shipping addresses of nearly 3,889 customers. A September 4 update revealed that roughly 67,000 additional US-based customers — whose data dated back to orders placed between November 2019 and August 2021 — were also affected. SatoshiLabs, Trezor's maker, said it had repeatedly received written confirmation from ShipMonk that customer data had been deleted, but it had not been.
On September 9, a second breach struck closer to home: Trezor's third-party email provider was compromised, and attackers used the legitimate sender domain to distribute phishing emails disguised as a critical security alert about an "STM32 Entropy Vulnerability." The lure is credible because STM32 is the family of microcontrollers inside Trezor devices, and entropy is the randomness used to generate recovery phrases.
Swiss hardware wallet maker BitBox separately reported that its newsletter provider was likely compromised on the same day, with phishing emails sent to its subscribers. BitBox said multiple Bitcoin companies sharing the same provider appear to have been targeted.
"This is the first time since Trezor was founded in 2013 that we have experienced a breach that exposed customer phone numbers and shipping addresses," SatoshiLabs acknowledged, adding that wallets, private keys, and recovery backups were never exposed.
The attacks are not limited to email: Reddit users reported receiving scam phone calls and physical letters containing QR codes that lead to phishing sites. The convergence of real shipping data with phishing infrastructure makes these attacks unusually dangerous, as victims see legitimate-looking correspondence referencing actual order details.
Chainalysis has warned that violent attacks targeting crypto holders have surged in 2026, with an estimated $30 million extracted through physical robberies in the first half of the year alone. If the trend continues, 2026 could surpass 2025's total of $58 million in violent crypto thefts.
Trezor advises customers never to enter recovery phrases on websites prompted by email, to treat unexpected phone calls and letters as hostile until verified, and to check trezor.io or the company's verified X account for genuine notices.
