Cybersecurity

Trezor Breach Turns Addresses Into a Target List

ShipMonk, Trezor's shipping provider, was breached through a Metabase flaw, exposing addresses of nearly 13,700 hardware wallet buyers. Chainalysis data shows why that list is worth more to criminals than a password.

CybersecurityBy Servola Tech Desk2026-08-134 min read

AI-assisted, edited by humans. | Editor-in-Chief: Leon Soliman | Editorial standards

Trezor Breach Turns Addresses Into a Target List

Key takeaways

Trezor disclosed on August 13, 2026 that ShipMonk, its shipping provider, was breached, exposing the names, phone numbers and shipping addresses of 11,742 customers and partial data on 1,947 more, across the US, UK, Sweden, Colombia, Brazil, Italy and Portugal, for orders placed between May 10 and August 8, 2026.
ShipMonk told Trezor the intruder used a SQL injection flaw in Metabase, the same analytics software behind an earlier breach that hit Framework, Tally and LexisNexis this month, and ShipMonk separately received extortion emails from the ShinyHunters gang.
Trezor says its own systems and devices were not touched; the company called it the first breach in its history to expose customer phone numbers and shipping addresses.
The original Servola read: a mailing-list breach at most companies is a phishing problem, but a mailing list that ties a verified home address to confirmed ownership of a self-custody crypto wallet is a target list for the physical crime wave Chainalysis tracks, not just a scam-email risk.
Chainalysis puts violent, in-person crypto theft at over $30 million in the first half of 2026 alone, already on pace to pass all of 2025's total, which is the number that should set the response here, not the usual breach-notice boilerplate.

What ShipMonk exposed, and when

On August 13, 2026, Trezor told customers that ShipMonk, the third-party warehouse and shipping provider it uses to fulfil hardware wallet orders, had informed it three days earlier, on Monday August 10, of unauthorized access to systems holding customer data. The exposure covers orders placed between May 10 and August 8, 2026: 11,742 customers had their full name, email address, phone number and shipping address exposed, and a further 1,947 had a narrower set, name, city and email, taken.

The affected customers span at least seven countries: the United States, the United Kingdom, Sweden, Colombia, Brazil, Italy and Portugal. Trezor said it notified every affected customer directly by email and that anyone who did not receive a notice was not part of the exposure.

The same flaw, a different kind of victim

ShipMonk told Trezor and its own customers that the intrusion traced back to a SQL injection vulnerability in Metabase, the business-intelligence platform many companies plug into their operational data to run internal dashboards. That is notable because a separate wave of breaches earlier this month, at Framework, Tally and LexisNexis, traced to the same underlying Metabase flaw, with attackers using an unauthenticated password-reset endpoint to gain administrator access to each company's instance in turn.

ShipMonk also confirmed it received extortion emails from ShinyHunters, a group with a long track record of following up SaaS and BI-platform intrusions with direct payment demands to the breached company rather than, or in addition to, quietly reselling the data. Trezor was explicit that its own hardware, firmware and account systems were never touched: ShipMonk only ever held the fulfilment data Trezor gave it to get a package to a doorstep, and Trezor called this the first breach since its 2013 founding to expose customer phone numbers and shipping addresses.

Why a shipping address here is worth more than a password

Most vendor breaches of this shape get filed under the same heading: expect more convincing phishing email. That framing understates what is different about a shipping list tied to a hardware crypto wallet order. Every name on it is a verified, physical-address-confirmed owner of self-custody crypto hardware, a combination that criminals researching in-person targets cannot usually get from a stolen SaaS customer list, a leaked forum dump, or on-chain analysis alone.

Chainalysis, the blockchain analytics firm that tracks crypto-related crime, has documented an escalating run of violent, in-person attacks on crypto holders, so-called wrench attacks, kidnappings, home invasions and coercion carried out specifically because the victim was known or suspected to hold recoverable digital assets. Chainalysis figures put the value stolen in these physical attacks at more than 30 million dollars in the first half of 2026 alone, already on pace to exceed the roughly 58 million dollars tracked for the whole of 2025. A list that hands an attacker a name, a home address and hard proof of hardware-wallet ownership is precisely the input that trend runs on.

Where the standard playbook falls short

The instinct after a breach like this is to reach for the anti-phishing checklist: watch for fake delivery texts, do not click unexpected links, verify any request to confirm an address before replying. Those steps matter, but they answer the wrong threat model here. Phishing targets a screen. A wrench attack targets a front door, and no amount of email hygiene changes who now has a customer's real address on file alongside proof they own a hardware wallet.

The more useful response for anyone on Trezor's affected list is physical, not digital: treat unsolicited in-person contact, callers claiming to be couriers, technicians or officials, with the same suspicion as a phishing email, avoid publicly confirming crypto holdings tied to a home address, and, where the exposure includes a full address, consider it a signal to review physical security at that location rather than only rotating passwords that were never at risk. For any business that ships a product whose ownership alone marks a customer as wealthy, whether crypto hardware, jewelry, or high-value electronics, that same logic applies: a fulfilment vendor's data is not just a privacy asset, it is a target list waiting to be built, and it deserves a physical-risk review alongside the usual vendor-security audit.

Frequently asked questions

Was Trezor itself hacked?

No. Trezor says its own systems, firmware and hardware wallets were not touched. The breach happened at ShipMonk, the third-party shipping provider Trezor uses to fulfil orders.

What data was exposed in the ShipMonk breach?

For 11,742 customers: full name, email address, phone number and shipping address. For a further 1,947 customers: name, city and email address only. No payment data, passwords or wallet recovery information was involved.

Is this the same incident that hit Framework, Tally and LexisNexis?

It is a separate incident at a different company, but ShipMonk says the intrusion used the same type of SQL injection flaw in Metabase that was behind the earlier Framework, Tally and LexisNexis breaches this month.

What should affected Trezor customers do?

Beyond the usual phishing precautions, treat this as a physical exposure: be wary of unsolicited in-person contact, do not confirm crypto holdings to unverified callers or visitors, and consider reviewing home security if your full shipping address was among the data exposed.

A SaaS vendor breach at a laptop maker or a legal database is a data problem. The same breach at a company whose only product proves you own recoverable crypto, shipped straight to your front door, is a different category of risk, and Chainalysis's own numbers on violent crypto theft say the difference is not theoretical. Every business whose customer list doubles as a wealth signal should be asking what its fulfilment vendor knows, not just what it stores.

TrezorShipMonkMetabaseShinyHuntersChainalysisdata breachphysical security

Gunra Ransomware Runs on Fortinet Bugs Patched in 2025

CISA, the FBI, NSA and South Korea jointly named Gunra ransomware on August 10. It breaks in through two Fortinet flaws patched over a year ago. The real finding is patch lag, not the malware.

3 min read

Cybersecurity

Langflow's Two-Call Chain Handed Root to 295 Attackers

CVE-2026-9198 chains two Langflow API calls into unauthenticated root access. CISA confirmed active exploitation; 756 attempts from 295 IPs logged by August 12. Why shadow AI tooling is the real gap.

4 min read

Decisions

The Third Pivot Was the Warning Magic Leap Missed

Magic Leap filed a WARN notice for 193 layoffs effective 1 October 2026, its fourth strategic pivot after $4 billion raised. The lesson is the pattern, not the pivot.