Trezor: 13,000 clients exposed in a breach at its logistics provider

Trezor, the hardware wallet manufacturer, confirms that the data of 13,000 European customers—including names, addresses, and emails—was exposed due to a breach at its logistics provider. The hardware supply chain attack strikes again.

Context

Trezor, manufacturer of hardware wallets (physical cryptocurrency wallets), confirms a data breach affecting 13,000 European customers. The exposed data includes names, addresses, and emails. The source of the breach: not Trezor directly, but its logistics provider—a third-party supplier in the supply chain.

Data

• 13,000 customers affected (Europe)
• Exposed data: names, addresses, emails
• Vector: third-party logistics provider (not Trezor directly)
• Source: The Register

Analysis

The Register’s phrasing perfectly sums up the lesson: "Even if your hardware is secure, quantum-ready, encrypted, and future-proof, no one is immune to a supplier letting the side down."

This is the paradox of the hardware wallet: you buy a device precisely for its maximum security—key isolation, resistance to network attacks, verifiable firmware—and it’s the transporter that leaks customer addresses. The threat wasn’t cryptographic: it was logistical.

This pattern is now well-documented in our tracking of hardware supply chains. The weak link isn’t the product; it’s the third-party provider—logistics, customer service, distributor—that handles customer data without the same security standards.

Concrete risk for the 13,000 affected: targeted phishing. An attacker who knows your postal address AND that you own a crypto hardware wallet knows you likely have digital assets to target. Phishing emails impersonating Trezor will follow.

What to do if you are a Trezor customer

• Extreme caution toward any email or letter claiming to be from Trezor
• Never enter your seed phrase (24 words) on any device other than your physical Trezor
• Enable the passphrase (25th word) on your Trezor if not already done—additional protection even if the device is stolen