Trezor confirms 13,689 customers exposed in ShipMonk logistics breach
ShipMonk notified Trezor on Aug 10 that an attacker exploited a vulnerability in Metabase, a third-party analytics tool, to reach order data. 11,742 records included full name, email, phone and shipping address; 1,947 were name/city/email only. Orders May 10 – Aug 8 across US, UK, Sweden, Colombia, Brazil, Italy, Portugal.
This is a physical-security incident, not a crypto one. A list of confirmed hardware-wallet owners with home addresses is the raw input for wrench attacks and targeted phishing.
Trezor commits to anonymous delivery — EU by September, US by year-end
Trezor's 90-day data-retention policy capped the blast radius, and the company is now shipping an anonymous delivery option plus a phishing warning to all affected buyers.
Retention limits worked as designed. It's a concrete argument that privacy-by-default engineering is cheaper than incident response.
Coldcard laundering trail stays thin — one 64.9 BTC Wasabi deposit, 200 ETH to Tornado Cash
Despite $130M+ stolen, on-chain movement of the proceeds remains minimal — consistent with a patient actor waiting out attention rather than a smash-and-grab.
Dormant stolen supply is an overhang. When it moves, it moves fast, and mixers are the tell.