← News
/DISPATCH · 2026-08-16

Trezor Hardware Wallet Logistics Vendor Data Breach: 11,742 Users' Names, Addresses, Emails, Phones Exposed; Multi-Country Regulators Tighten Anonymous Shipping

On 2026-08-14, hardware wallet vendor Trezor disclosed a third-party logistics data breach. Names, shipping addresses, phones, and emails of 11,742 users in the US, UK, Sweden, Colombia, Brazil, Italy, and Portugal were exposed. Names, cities, and emails of 1,947 additional customers were also stolen. Second incident targeting hardware wallet holders in two weeks.

Incident Overview

On 2026-08-14, the Financial Times disclosed that cryptocurrency hardware wallet vendor Trezor (brand of Czech company SatoshiLabs) suffered a third-party logistics vendor data breach. It affected 11,742 users who received devices between 2026-05-10 and 2026-08-10. Names, shipping addresses, phone numbers, and email addresses were exposed together. Separately, names, cities, and emails of 1,947 additional customers leaked. Trezor acknowledged the incident and confirmed affected users are in seven countries: United States, United Kingdom, Sweden, Colombia, Brazil, Italy, and Portugal. This is the second major security incident targeting hardware wallet holders in two weeks, after the 2026-08-11 Coinkite Coldcard firmware RNG defect that led to $110 million in Bitcoin theft.

Technical Details

The leak occurred in Trezor's outsourced logistics delivery and customs clearance path, not from compromise of Trezor's own servers or firmware. Attackers broke into the third-party logistics system and obtained the complete order-fulfillment database. Direct cause: the logistics vendor order system and Trezor backend synced on key fields without minimization, so names, addresses, and phones all entered the logistics vendor's visible scope. Trezor states no derived fraud, account takeover, or physical-threat incidents have been observed. Real identity plus address of holder profiles is exactly the prerequisite data for targeted spear-phishing combined with offline wrench attacks.

Impact Assessment

The hardware wallet security model depends on the physical device never leaving the holder and the seed phrase never touching the network. Real identity plus geolocation exposed at purchase and delivery can overturn that premise. Attackers can then run targeted spear-phishing (impersonating Trezor support demanding a firmware upgrade), address poisoning (delivering fake hardware wallets to relatives at the same address), or offline wrench attacks (physical coercion for the seed phrase). The Coldcard $110 million loss stacked with this 11,742-person PII leak means hardware wallet threats have expanded from side-channel/TEE bugs to order-ops leakage. Crypto-community practices of not reusing addresses and not disclosing holdings now also need an upgrade: do not expose shipping addresses.

Remediation

Sources