Trezor Data Breach: Fake Alerts, QR Letters, What to Do

Marcus bought a Trezor in 2020 and has not thought about the order since. Last week an email arrived, addressed to him by name, quoting his order number, saying his device firmware had a fault and he should confirm his wallet backup on a linked page to keep his coins safe. Everything in it was accurate except the sender. His name, email address, phone number, home address and that order number sat in a file from the Trezor data breach at its shipping provider. So the person holding it needed only one more thing from him: the 24 words.

Confirmation: confirmed by the company. Trezor published a notice on 13 August 2026 and updated it on 4 September 2026 with the larger count.

What happened in the Trezor data breach

The Trezor data breach exposed the names, email addresses, phone numbers and home addresses of 80,689 customers, taken from Trezor’s shipping provider ShipMonk. Trezor’s own systems were not breached, and no device, private key or wallet backup was touched. The timeline is in Trezor’s notice.

What makes this breach different is the date range. Trezor’s first notice on 13 August covered 13,689 recent orders. Then on 2 September it learned the stolen data also held orders from November 2019 to August 2021, from an earlier period with ShipMonk. Trezor deletes order data 90 days after delivery, and says it had “repeatedly requested and received written assurance confirming the deletion.” The data was still there. That added roughly 67,000 US customers who had every reason to think their order was long gone.

Three waves in five weeks

Trezor owners have now been hit three separate ways, and each one used what the one before it exposed.

The data (10 August to 4 September). ShipMonk told Trezor on 10 August that customer data had been accessed. BleepingComputer reported that notification emails describe the way in as a flaw in Metabase, a reporting tool, the same one used against Mathspace, Framework and Tally, and that ShipMonk received extortion emails from the ShinyHunters group. Trezor has not said how ShipMonk was breached.
The email (9 September). Attackers got into Brevo, the service Trezor uses for its newsletter, and sent “Critical Security Alert: STM32 Entropy Vulnerability” from a spoofed Trezor address to about 347,000 subscribers. TechCrunch reported the attackers accessed 138 Brevo accounts, and that the link downloaded an app asking for the wallet backup. BleepingComputer reported that about 2,500 people clicked in the roughly twenty minutes before Trezor took it down.
The letter (September). TechCrunch reported that some people have received letters by mail claiming to be from Trezor, with a QR code that opens a fake page. A letter reaches the one channel no inbox rule touches: your front door.

This has happened before. In January 2024, a breach at Trezor’s third-party support portal exposed about 66,000 names and email addresses. Those were later used in phishing campaigns asking for recovery seeds.

What the Trezor data breach exposed

For most of the 80,689 people, the file holds full name, email address, phone number, shipping address and order number. For 1,947 of them, only name, city and email address. The file does not list what was in the parcel, but the sender was Trezor, so it does not need to.

Your email plus the fact that you own a hardware wallet. That is the whole value of the file. A generic crypto phish is easy to ignore; one that names you and quotes your real order number is not.
Your phone number. A call or text from “Trezor support” about a firmware problem. Trezor does not call customers about security incidents.
Your order number and date. “Regarding order #TR-xxxxx” is the line that gets a fake opened.
Your home address. The QR-code letters show it is already being used. TechCrunch also names the worst case plainly: targeted violence, the so-called “wrench” attack.

No password leaked, because ShipMonk did not hold one. No seed leaked, because Trezor does not hold yours. Every wave above is built to make you hand over the seed yourself.

What to do now

Never enter your recovery seed anywhere except the device. Not a website, not an app, not a form reached from an email, a text or a QR code on a letter. The device asks for the seed on its own screen during recovery, and nowhere else. This one rule defeats all three waves.
If you clicked the 9 September email and typed anything, move your funds now to a new wallet with a fresh seed, from a device you trust. Then work out what happened.
Treat every message about Trezor, firmware, your order or this breach as suspect, including a letter. Open trezor.io or Trezor Suite yourself and check the official blog.
Hang up on “Trezor support.” Your number is in the file, and the call will sound informed.
Protect the email account on that order first, because it is the reset route into your exchange accounts. Use a passkey where you can, an authenticator app otherwise.

Your front door: the part an inbox can’t fix

A home address next to “owns a hardware wallet” is a physical risk, and it deserves physical answers. A passphrase-protected hidden wallet means the seed alone does not open your main holding, so a smaller decoy wallet can sit in front of it. Do not discuss holdings where your name and town are visible. For future orders, Trezor’s own advice is to use a P.O. box if possible to limit address exposure, and an email address that is not linked to your real identity. If a letter or a visitor claims to be from Trezor, the answer is the same as for email: the company will never ask for your seed.

How OptMsg changes this exposure

OptMsg would not have prevented the Trezor data breach, and it cannot stop a letter or a phone call. What it changes is the second wave. OptMsg’s patent-pending opt-in technology means mail from a sender you have not approved goes to Trash, not your Inbox, and auto-deletes after 30 days. So a fake firmware alert from a sender you never approved is not waiting in front of you with a twenty-minute clock. Only people you approve can reach your inbox. Everyone else goes to Trash.

The Brevo wave is the honest edge case: it came through Trezor’s own newsletter service, so if you had approved Trezor, a message spoofing that sender needs the seed rule above, not an inbox rule. An OptMsg account also has no password, so a password stolen from another site can’t open the inbox where your exchange resets land. See how Simple by Design works, or read what opt-in email is and how it shields your inbox.

Ready for an inbox that stays quiet after a breach? Create Your Account.

Your Inbox. Your Rules.

Frequently asked questions

Are my coins at risk from the Trezor data breach? Not from the leaked data itself. The risk is an email, call, text or letter that uses your details to get you to enter your recovery seed somewhere. Do not.

I ordered in 2020. Why is my data in this? Trezor deletes order data 90 days after delivery and says ShipMonk confirmed in writing that data from November 2019 to August 2021 was deleted. On 2 September Trezor learned it had not been. That is where the extra 67,000 US customers come from.

Was the STM32 security alert email real? No. It was sent on 9 September through Trezor’s compromised newsletter provider, Brevo, to about 347,000 subscribers. If you clicked and entered anything, move your funds to a new wallet with a fresh seed now.

I got a letter from Trezor with a QR code. Is it real? Treat it as fake. TechCrunch reported letters claiming to be from Trezor whose QR code opens a fake page. Go to trezor.io yourself; Trezor will never ask for your seed.

Would OptMsg have stopped this? No. The breach happened at ShipMonk. What OptMsg changes is the email wave: unapproved senders go to Trash rather than your Inbox, and there is no password on an OptMsg account for a leaked credential to match.