After a breach at shipping partner ShipMonk, attackers obtained Trezor customers’ contact and shipping details, increasing the risk of scams. Reports on Reddit indicate customers have already received phishing phone calls and physical letters containing QR-code phishing lures. Trezor warned customers to watch for scam emails, calls, and letters and noted the leak could also create physical safety risks.
This case began not with a hack of Trezor's own systems but with a breach at ShipMonk, a shipping partner that handled order fulfillment. That breach exposed customer names, email addresses, phone numbers, and shipping addresses. Trezor has stated that its own infrastructure was not compromised and that customer devices remain secure, but the exposed contact and shipping data still gave attackers enough material to run convincing scams.
Customers began reporting two distinct follow-on attacks. Some received phishing phone calls, likely referencing real order details to sound legitimate. Others received physical letters containing QR codes, a channel that is harder for typical security awareness training to cover since it does not arrive by email.
The scams succeeded because they combined real, leaked personal details with unusual delivery channels. A caller who knows your name, address, and that you recently ordered a hardware wallet sounds credible, especially when the pretext is framed as a delivery or security verification issue. Similarly, a physical letter with a QR code bypasses email spam filters and browser warnings entirely, and recipients may not expect phishing to arrive through the mail.
Trezor has advised customers to treat any unexpected call, email, or letter referencing their order as suspicious and to verify through official channels before acting. Customers should avoid scanning QR codes from unsolicited letters and instead navigate directly to the vendor's known website. Trezor is also reportedly working on more anonymous delivery options, including locker pickup, neutral packaging, generic sender details, and automatic deletion of shipping identifiers after delivery.
More broadly, anyone purchasing high-value items like crypto hardware wallets can reduce exposure by using an anonymous email address for orders and limiting public disclosure of their holdings. Because crypto holders can face elevated real-world risk, minimizing the trail of personal data tied to a purchase, and staying alert to both digital and physical phishing attempts, is a practical way to reduce follow-on risk after any third-party data exposure like this one.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
A breach at Trezor's shipping partner, ShipMonk, exposed customer names, email addresses, phone numbers, and shipping addresses, which could then be used to craft convincing scam contacts.
Customers reported receiving phishing phone calls and physical letters containing QR codes designed to lure recipients into scanning them, according to reports on Reddit.
Trezor says its own systems were not compromised and that customers' devices remain secure; the exposure came from its shipping partner ShipMonk.
Treat any unexpected Trezor-related call, email, or letter as suspicious and verify it using known official channels before acting, and avoid scanning QR codes from unsolicited letters.
You get a call: “Hi, I’m from Trezor support about your recent order at this address…” and they read out your home address. After a breach at shipping partner ShipMonk, scammers got real Trezor customer names, emails, phone numbers, and shipping addresses. Now they’re using them for phishing calls and fake security letters with QR codes. The trick: they sound legit because they know your last Trezor order and address, then push you to ‘verify’ details or scan a QR code to secure your wallet. That site or call flow is built to steal your seed phrase or funds. If anything Trezor-related contacts you out of the blue, call, email, or letter, do one thing: hang up or ignore it, then go to trezor.io yourself and use the official support contact from there.
The bulletin describes real-world social engineering where staff were tricked into disclosing sensitive data or access. In one case, Revolut employees responded to fraudulent information requests sent from a real government-domain email account, exposing extensive customer records. Separately,…
Trezor reported that about 347,000 customers received phishing emails after attackers abused a breach at its third‑party email marketing provider, Brevo. The phishing message used a “Critical Security Alert” theme and linked to a malicious site that attempted to trick users into entering their…
Trezor said attackers breached its third-party email provider (Brevo) and gained access to Trezor’s email domain, triggering phishing emails to subscribers. The scam emails used a fake “critical security alert” about a supposed microcontroller vulnerability and attempted to trick users into handing…
Researchers found a crypto fraud operation that used AI-assisted tooling to sift and verify over 100,000 phone numbers, then target confirmed crypto users. The campaign used a one-two approach: phishing messages that included a case/verification code, followed by phone calls that referenced those…
Researchers described a real fraud operation that first verified which phone numbers were tied to cryptocurrency exchange accounts, then targeted confirmed owners. The attackers used phishing emails, vishing calls, and fake wallet apps while impersonating popular hardware/software wallet brands,…
Rapid7 uncovered an active cryptocurrency fraud operation that combined phishing emails, follow-up phone calls, and counterfeit wallet apps to trick victims into handing over wallet recovery (seed) phrases. The attackers validated and enriched phone-number leads first, then used matching “support…
