ShipMonk is subject to Trezor's 90-day retention policy, which requires partners to delete or anonymize customer data within 90 days of collecting it for an order.

ShipMonk did not immediately respond to a request for comment.

Trezor markets itself as a purveyor of secure, offline, hardware-based cryptocurrency wallets. With its products, it aims to shield customers from cyberattacks and malicious apps.

While it assured customers that its own systems and devices remain secure, Trezor warned that "affected customers could experience an increase in phishing attempts."

The exposed details could help criminals craft convincing phishing attempts impersonating banks, crypto exchanges, or Trezor itself.

The company said it contacted affected customers directly and advised them to check any communications against information published through its official channels.

"Never enter your wallet backup on a website or share it with anyone," Trezor said in an apologetic advisory.

"This is the first time since Trezor was founded in 2013 that we have experienced a breach that exposed customer phone numbers and shipping addresses.

"We absolutely understand how serious this is and the potential risks it poses to our customers and are deeply sorry to those affected."

Trezor said in a supplementary social media post, separate from the advisory, that its "top priority" project at the moment is to establish an "Anonymous Delivery" option for customers.

The service will allow buyers to complete checkout without linking their home address or real-world identity to an order.

Customers using Anonymous Delivery will go through a dedicated checkout, use a nickname or label ID in place of a real name, and have their product shipped to an automated delivery locker instead of their home. 

The delivery will also come in unbranded packaging with a generic sender label. The carrier will only use email or SMS to send a PIN for the locker.

Trezor said the service is gearing up for a September launch in the EU and by the end of the year in the US.

Alas, that didn't stop Cake Wallet, a rival crypto wallet, from poking fun at Trezor.

"Another rough day for self custody," it Xeeted, before suggesting crypto holders instead use an old smartphone with Cake Wallet installed because "there is no order, no shipping address, or customer data tied to the purchase." ®