Trezor Customer Data Exposed in Shipping Partner Breach

Phishing and “wrench attacks”

Trezor's warning concerns phishing, and it advises customers to treat unexpected contact with suspicion and never to enter a wallet backup online. The 2020 precedent at rival Ledger suggests the risk runs further than fraudulent email.

After roughly 272,000 Ledger customers had names, addresses and phone numbers published, some began receiving ransom demands threatening violence. One told Decrypt they received multiple emails and texts a day, while others later reported receiving phishing calls from people who spoke as though they knew them.

Those threats now have more company, with CertiK verifying 52 physical attacks on crypto holders worldwide in the first half of 2026, up from 39 a year earlier, and home invasions overtaking kidnapping as the most common method. Chainalysis put the sum stolen at more than $30 million over the same period and said the year was on course to be the worst on record.

This isn't the first such incident to strike at the vendor chain for hardware wallets. Ledger disclosed a breach at its own e-commerce partner, Global-e, in January, and hardware wallet firms warned of a phishing surge this month as losses from the Coldcard exploit approached $130 million.

The news lands as hardware wallet users were rocked by the recent Coldcard exploit. Some of the 233,000 BTC that left long-term holder wallets around the Coldcard breach, worth roughly $15 billion, came from Ledger and Trezor owners rather than Coldcard customers, moving to multi-signature setups after watching the exploit unfold, according to Casa.

Trezor said it is bringing forward an Anonymous Delivery option using locker pickup, neutral packaging, generic sender details and automatic deletion of shipping identifiers, targeting the European Union by September and the United States by the end of the year.