Trezor customer data exposed through a shipping partner, Decrypt reports — scope still undisclosed

Customer data belonging to users of Trezor, the Czech hardware wallet maker, was exposed in a breach at one of the company's shipping partners, according to a report published by Decrypt at 13:10 UTC on August 13, 2026.

That is, at this stage, close to the whole of what is on the record. The logistics provider has not been named. No record count has been put out. Which fields were exposed — names, email addresses, physical shipping addresses, order histories, or some combination — has not been specified, and there is no public confirmation of when the breach occurred or how long the data sat exposed. Trezor has not published a corresponding incident notice, and no regulatory disclosure has surfaced alongside the report. Decrypt's account does not identify the partner or attribute the finding to a named investigator.

The distinction that matters for wallet holders: an exposure at a shipping vendor is a customer-list problem, not a key-material problem. Hardware wallet seed phrases are generated and stored on the device and are never held by the shipping chain, so a breach of fulfilment records does not by itself put funds at risk. What it does put at risk is the mapping of real names and home addresses to people known to hold crypto in self-custody — the raw input for targeted phishing, fake "recall" or "firmware update" mailers, and, at the tail end, physical coercion. Whether any of that data was in fact exposed here has not been established publicly.

For market context, Decrypt's price ticker at the time of publication showed bitcoin at $63,857 and ether at $1,892.91. No move in either has been attributed to the report.

Key facts

• Trezor customer data was exposed in a breach at a shipping partner — Decrypt, published 2026-08-13, 13:10 UTC.
• Shipping partner not named; number of affected customers not stated; exposed data fields not specified — Decrypt.
• No Trezor incident statement, breach notification or regulatory filing has surfaced alongside the report as of this writing.
• BTC $63,857, ETH $1,892.91 at time of Decrypt's publication — Decrypt price ticker.

The real-world read

Treat this as a single secondary report until it is corroborated. There is no primary source here — no company statement, no notification letter, no filing — and the load-bearing details are precisely the ones missing. "Shipping partner breach" is also the most convenient available framing for a hardware wallet vendor: it locates the failure outside the company while leaving open how much customer data was handed to that partner in the first place, and under what retention terms. Until Trezor names the vendor and the affected fields, the exposure cannot be sized, and anyone claiming a figure is guessing. Note too that hardware wallet customers are a high-value phishing list; the practical harm from this class of incident usually arrives weeks later, by email.

Opinion, and whose

None is offered here beyond the reading above, which is Cleartext's. No analyst, security researcher or company representative has been quoted assessing the incident's severity.

Sources

• Decrypt, "Trezor Customer Data Exposed in Shipping Partner Breach," 2026-08-13 13:10 UTC — the sole report of the breach; secondary, and does not name the shipping partner or an underlying source. Also the origin of the BTC and ETH prices cited. Not marketing or sponsored.

Nothing here is financial advice.