Trezor customers hit with phishing calls and letters after shipping-partner breach
A breach at shipping partner ShipMonk exposed data for about 67,000 additional US Trezor customers, who now face phishing calls and QR scam letters.
SatoshiLabs, maker of Trezor hardware wallets, confirmed the August 2026 ShipMonk breach exposed names, emails, phone numbers, and shipping addresses for roughly 67,000 US customers who ordered between November 2019 and August 2021, on top of 3,889 customers affected initially. ShipMonk attributed the intrusion to attackers exploiting an SQLi zero-day in Metabase's Cloud SaaS platform and retained data past the 90-day deletion requirement. Trezor's own systems were not compromised; customers are reporting phishing calls and QR-code phishing delivered via physical letters.
- Exploited SQLi zero-day in Metabase Cloud SaaS enabled access to retained shipping data
- Affected orders shipped to US, UK, Sweden, Colombia, Brazil, Italy, and Portugal
- Chainalysis estimates violent crypto attacks extracted over $30M from holders in 2026
- Trezor plans anonymous delivery options; customers advised to use decoy wallets and P.O. boxes
- Vendors
- ShipMonkMetabaseChainalysis
- Products
- Trezor
- Victims
- SatoshiLabs
- Organizations
- SatoshiLabs
From the original article
3 min read at helpnetsecurity.com
Roughly 67,000 more customers of SatoshiLabs, the maker of hardware crypto-wallet Trezor, are at heightened risk of phishing attacks after their names, email addresses, phone numbers, and shipping addresses were exposed.
By Zeljka Zorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.