Trezor’s disclosure that a breach at its shipping partner ShipMonk exposed 13,689 customers’ names, phone numbers and home addresses has mostly been covered as a routine data-leak story. Changpeng Zhao, Binance’s founder, read it differently. “Not a great month for hardware wallets,” he wrote on X. “The leak directly links identities and physical addresses to known crypto holders, creating significant phishing, social-engineering and potential physical-security risk.” Zhao went on to argue the incident favors software self-custody wallets like Binance’s own Web3 Wallet and Trust Wallet, since they carry no physical device or shipping address to leak in the first place. He disclosed in the same post that YZiLabs, tied to Binance, is an investor in several hardware wallet makers, and framed the comparison as one of risk profiles rather than one product being unsafe.
Not a great month for hardware wallets.
Trezor disclosed a breach at its shipping provider affecting ~13.7K recent customers. ~11.7K had full name, email, phone and shipping address exposed. Trezor systems/private keys were not compromised. The leak directly links identities and…
— CZ 🔶 BNB (@cz_binance) August 13, 2026
That distinction matters because the risk isn’t hypothetical. Chainalysis’s own data shows violent crypto theft reached $58 million in 2025, the highest on record, with more than $30 million stolen in the first half of 2026 alone. Home invasions made up 37% of documented incidents through mid-2026, up from 26% in 2023. A leaked address alone doesn’t cause a break-in, but it removes the first and hardest step for anyone planning one: finding out who to target.
A case that shows the pattern already works
A couple in Somme, France, learned that the hard way this summer, though not because of the Trezor breach. Attackers broke into their home three times in under a month, on June 24, June 26 and July 17, looking for roughly €1 million in cryptocurrency that the couple didn’t have. The previous owners, who did hold that crypto, had their address linked to them through a separate 2024 leak, tied to a French tax official who sold dossiers on wealthy crypto holders. On June 26, one resident was tied up and beaten while the attack was streamed on Snapchat. Two men, aged 20 and 21, were later sentenced by a court in Amiens. The couple decided to sell the house.
Nothing connects that leak to ShipMonk. What connects the two cases is the underlying fact: once a name is tied to a home address and to cryptocurrency, that pairing has already led to home invasions, at least once with people who didn’t even hold the assets attackers were looking for.
What the ShipMonk data does and doesn’t include
Trezor has confirmed that the exposed fields are full name, email address, phone number and shipping address for 11,742 customers, with a further 1,947 limited to name, city and email. What Trezor has not said, and what no reporting on the breach has confirmed either, is whether order value or wallet model was part of what leaked. That detail matters more than it sounds: it’s the difference between a list of addresses and a ranked list of addresses, sorted by how much hardware, and implicitly how much cryptocurrency, someone is likely to be holding.
What buyers can actually do about it
Mert, a pseudonymous figure who posts as @mert, replied to Trezor’s own announcement with a list of practical steps that has circulated widely since. Among them: use an email alias for purchases rather than a primary address, avoid giving a full legal name where a site doesn’t require one, never rely on a single-signer setup even with a hardware wallet, use a hardware MFA key like a Yubikey instead of SMS-based codes, and ship sensitive purchases to a shared address, such as an office, rather than home. He also suggested running a basic audit of what a single compromised password or email could expose, and scaling these steps to individual risk rather than treating all of them as mandatory.
Trezor is the only one with a public fix so far
Trezor said it’s accelerating a feature called Anonymous Delivery, which would let customers collect hardware wallets from a locker under a nickname instead of shipping to their home under their real name, with neutral packaging and shipping details deleted after delivery. It’s due in the European Union by September and in the United States by the end of the year.
No equivalent commitment has turned up publicly from Ledger or Coldcard, the two other major hardware-wallet makers. That doesn’t mean nothing exists on their end, only that neither has said so. Until one of them does, or Trezor’s own rollout actually ships, the industry’s answer to “how do you buy a device that holds your crypto without telling a courier’s database where you live” is, for now, a single company’s still-unreleased feature.
AI Disclosure: Cryip uses AI-assisted tools to help refine language — correcting spelling and grammar and simplifying complex terms for readability.
We do this to make crypto topics easier to understand for readers at all experience levels. AI does not draft facts, sources, or conclusions. Every article is reviewed and approved by a human editor before publication. Read our full AI Use & Content Policy.
