Trezor–ShipMonk Supply-Chain Breach Hits 81,000 Customers: Defending Against the Coming Phishing Wave

Trezor has disclosed that the August data breach at its shipping and logistics provider, ShipMonk, is significantly larger than first reported: an additional 67,000 U.S. customers are now confirmed affected, bringing the total impact to roughly 81,000 customers. The compromised data originates not from Trezor's own infrastructure but from a third-party fulfillment partner — the classic supply-chain soft underbelly.

No private keys, seed phrases, or wallet contents were exposed — hardware wallets don't work that way, and Trezor has been clear on that point. But that is cold comfort. What was exposed is exactly the dataset a financially motivated threat actor needs to run high-conversion targeted phishing: names, email addresses, postal addresses, phone numbers, and order details that confirm the victim owns a Trezor device. In the crypto-threat landscape, a verified list of hardware wallet owners is a targeting list. We've seen this movie before with the Ledger breach in 2020, which fueled years of phishing, SIM-swapping, and even physical extortion attempts against customers.

If you are a defender, this matters on two fronts: (1) your employees who hold crypto are now high-value phishing targets, and crypto-themed credential harvesting bleeds into corporate environments constantly; and (2) this is a live case study in third-party logistics risk that belongs in your vendor risk management program today.

Technical Analysis

What happened

• Breach location: ShipMonk, a third-party shipping and logistics/fulfillment provider used by Trezor — not Trezor's own systems.
• Timing: The intrusion occurred in August; Trezor has now expanded the affected population by an additional 67,000 U.S. customers, for a total of approximately 81,000.
• Data exposed: Customer PII associated with hardware wallet orders — typically full name, email address, phone number, and physical shipping address. Order context itself is sensitive: it identifies the victim as a confirmed cryptocurrency holder with meaningful assets.
• Not exposed: Wallet seeds, private keys, PINs, passphrases, or funds. The hardware wallet security model is intact.

Why this dataset is dangerous

No CVE applies here — this is a third-party data breach, not a software vulnerability. The exploitation is social, and it follows a well-established pattern observed after prior crypto-adjacent breaches (Ledger 2020, Trezor's own 2022 Mailchimp incident, the 2024 Trezor support-ticket breach affecting ~66,000 contacts):

1. Spear phishing / smishing at scale. Attackers send emails and SMS impersonating Trezor: "security update required," "verify your device," "your wallet has been compromised — re-enter your recovery seed." Because the messages reference real names and real order history, click rates are far higher than generic spam.
2. Seed-phrase harvesting sites. Lookalike domains (trezor-suite[.]com, trezor-wallet-verify[.]net, trezor-support[.]io style patterns) hosting pixel-perfect clones of the Trezor Suite onboarding flow that prompt for the 12/24-word recovery seed. Whoever types a seed into a web page loses everything on the wallet.
3. Malicious "Trezor Suite" installers. Trojanized desktop apps pushed via phishing links or malvertising that steal seeds, clip crypto addresses from the clipboard, or act as clipper malware substituting attacker addresses during transactions.
4. SIM swapping and vishing. Phone numbers plus carrier-social-engineering gives attackers SMS 2FA on exchange accounts.
5. Physical risk. Home addresses of confirmed crypto holders have historically led to extortion and "wrench attack" threats after major wallet-vendor breaches.

Exploitation status

The breach itself is confirmed. Follow-on exploitation is the expected phase: there is no public PoC because none is needed — phishing kits for seed harvesting are commodity tooling, and breached crypto-customer lists trade actively on criminal forums. Defenders should treat targeted phishing against anyone on this list as already underway, not theoretical.

Detection & Response

The realistic detection surface for this threat is (a) your email gateway and web proxy catching Trezor-impersonation phishing, (b) DNS and network telemetry catching lookalike domains and seed-harvesting sites, and (c) endpoint telemetry catching trojanized "Trezor Suite" installers and clipper behavior. The rules below are tuned to that.

Sigma Rules

---
title: Trezor Lookalike Domain DNS Resolution
description: Detects DNS queries for domains that impersonate Trezor branding, a common indicator of seed-harvesting phishing pages and malicious wallet-installer distribution following crypto customer-data breaches.
author: Security Arsenal
date: 2026/02/14
status: experimental
references:
  - https://www.bleepingcomputer.com/news/security/trezor-data-breach-impact-now-reaches-81-000-customers/
  - https://attack.mitre.org/techniques/T1566/002/
logsource:
  category: dns
detection:
  selection_keyword:
    query|contains:
      - 'trezor'
      - 'trez0r'
      - 'trezorr'
      - 'trezor-suite'
      - 'trezorwallet'
      - 'trezor-support'
      - 'trezor-verify'
  filter_legitimate:
    query|contains:
      - 'trezor.io'
      - 'satoshilabs.com'
  condition: selection_keyword and not filter_legitimate
falsepositives:
  - Typos of the legitimate trezor.io domain
  - Security research and threat intel lookups
level: high
---
title: Potential Trojanized Trezor Suite Installer Execution
description: Detects execution of unsigned or oddly-located binaries masquerading as the legitimate Trezor Suite desktop application. Seed-harvesting campaigns distribute fake installers via phishing links following hardware-wallet customer data breaches.
author: Security Arsenal
date: 2026/02/14
status: experimental
references:
  - https://www.bleepingcomputer.com/news/security/trezor-data-breach-impact-now-reaches-81-000-customers/
  - https://attack.mitre.org/techniques/T1204/002/
logsource:
  category: process_creation
  product: windows
detection:
  selection_name:
    Image|contains:
      - 'trezor'
    CommandLine|contains:
      - 'trezor'
  filter_legit_paths:
    Image|startswith:
      - 'C:\Program Files\Trezor Suite'
      - 'C:\Program Files (x86)\Trezor Suite'
  condition: selection_name and not filter_legit_paths
falsepositives:
  - Users installing Trezor Suite to a custom directory
  - Portable builds of the legitimate application
level: high
---
title: Clipboard Access Followed by Crypto Address Pattern Write
description: Detects PowerShell or script interpreters reading clipboard content, a behavior consistent with clipper malware that substitutes attacker cryptocurrency addresses during transactions. Frequently bundled with fake wallet software.
author: Security Arsenal
date: 2026/02/14
status: experimental
references:
  - https://attack.mitre.org/techniques/T1115/
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
  selection_clip:
    CommandLine|contains:
      - 'Get-Clipboard'
      - 'Set-Clipboard'
      - 'System.Windows.Forms.Clipboard'
      - 'Clipboard]::'
  condition: selection_img and selection_clip
falsepositives:
  - Administrative scripts manipulating clipboard content
  - Legitimate automation tooling
level: medium

KQL — Microsoft Sentinel / Defender

Hunt both the email/web lure side (Trezor impersonation in mail and DNS) and the endpoint side (fake Suite installers, clipper behavior). Assumes mail flow logs via EmailEvents/EmailUrlInfo in Defender XDR and DNS via DeviceNetworkEvents; swap in CommonSecurityLog if your DNS comes via CEF/Syslog from a firewall or DNS appliance.

// Hunt 1: Trezor-impersonation emails and lookalike domains across mail + DNS
let lookalikes = dynamic(["trezor-suite", "trezorwallet", "trezor-verify", "trezor-support", "trez0r", "trezorr", "trezor.io-", "suite-trezor", "trezor.app", "trezorsuite"]);
union isfuzzy=true
    (EmailUrlInfo
    | where Url has_any (lookalikes)
    | where Url !has "trezor.io" or Url has "trezor.io-"
    | project TimeGenerated, Url, UrlDomain, NetworkMessageId),
    (DeviceNetworkEvents
    | where TimeGenerated > ago(30d)
    | where RemoteUrl has_any (lookalikes)
    | where RemoteUrl !has "trezor.io" or RemoteUrl has "trezor.io-"
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP);

// Hunt 2: Execution of files masquerading as Trezor Suite outside the legitimate install path
DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where FileName has "trezor" or ProcessCommandLine has "trezor"
| where FolderPath !startswith "C:\\Program Files\\Trezor Suite"
   and FolderPath !startswith "C:\\Program Files (x86)\\Trezor Suite"
| project TimeGenerated, DeviceName, AccountName, FileName, FolderPath, SHA256, ProcessCommandLine, InitiatingProcessFileName
| sort by TimeGenerated desc;

// Hunt 3: Script interpreters touching the clipboard (clipper malware behavior)
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where FileName in~ ("powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe")
| where ProcessCommandLine has_any ("Get-Clipboard", "Set-Clipboard", "System.Windows.Forms.Clipboard")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, SHA256
| sort by TimeGenerated desc;

Velociraptor VQL

Use this artifact to sweep endpoints for fake Trezor Suite binaries (any process or on-disk file with "trezor" in the name that is not signed by SatoshiLabs and not in the standard install path) — a fast triage before deciding on full IR scoping.

-- Hunt: Suspicious Trezor-branded binaries outside legitimate install paths
-- Scope: process execution + on-disk artifacts in user-writable locations
LET legit_paths = {
  SELECT Exe FROM pslist()
  WHERE Exe =~ '(?i)Program Files.\\Trezor Suite'
};

SELECT Pid,
       Name,
       Exe,
       CommandLine,
       Username,
       CreateTime,
       authenticode(filename=Exe) AS Signature
FROM pslist()
WHERE (Name =~ '(?i)trezor' OR Exe =~ '(?i)trezor' OR CommandLine =~ '(?i)trezor')
  AND Exe NOT IN legit_paths.Exe;

-- Companion: enumerate trezor-named files in temp/downloads/desktop
SELECT FullPath,
       Size,
       Mtime,
       authenticode(filename=FullPath) AS Signature
FROM glob(globs=['C:/Users/*/Downloads/*trezor*',
                 'C:/Users/*/Desktop/*trezor*',
                 'C:/Users/*/AppData/Local/Temp/*trezor*',
                 'C:/ProgramData/*trezor*'],
          accessor='ntfs')

Verification & Hardening Script

For Windows fleets, this PowerShell script inventories Trezor-branded binaries outside legitimate paths, checks Authenticode signatures, and pulls recent DNS cache entries matching Trezor lookalike patterns — a quick compromise-assessment pass you can push via your RMM or run during IR triage.

# Trezor phishing / fake-installer compromise assessment
# Run elevated. Produces a CSV for review.
$report = @()

# 1) Trezor-branded executables outside legitimate install directories
$searchPaths = @("$env:USERPROFILE\Downloads", "$env:USERPROFILE\Desktop", "$env:TEMP", "C:\ProgramData", "C:\Users\Public")
foreach ($p in $searchPaths) {
    if (Test-Path $p) {
        Get-ChildItem -Path $p -Recurse -Include "*trezor*" -ErrorAction SilentlyContinue |
        Where-Object { $_.Extension -in '.exe','.msi','.msix','.ps1','.bat','.js' } |
        ForEach-Object {
            $sig = Get-AuthenticodeSignature -FilePath $_.FullName
            $report += [PSCustomObject]@{
                Type      = 'SuspiciousFile'
                Path      = $_.FullName
                Size      = $_.Length
                Modified  = $_.LastWriteTime
                SigStatus = $sig.Status
                Signer    = $sig.SignerCertificate.Subject
            }
        }
    }
}

# 2) Running processes referencing trezor
Get-Process | Where-Object { $_.Name -match 'trezor' -or $_.Path -match 'trezor' } |
ForEach-Object {
    $sig = if ($_.Path) { (Get-AuthenticodeSignature -FilePath $_.Path).Status } else { 'N/A' }
    $report += [PSCustomObject]@{
        Type      = 'Process'
        Path      = $_.Path
        Size      = ''
        Modified  = $_.StartTime
        SigStatus = $sig
        Signer    = ''
    }
}

# 3) DNS client cache entries matching trezor lookalike patterns
Get-DnsClientCache -ErrorAction SilentlyContinue |
Where-Object { $_.Entry -match 'trezor|trez0r|trezorr' -and $_.Entry -notmatch '^trezor\.io$|\.trezor\.io$|satoshilabs' } |
ForEach-Object {
    $report += [PSCustomObject]@{
        Type      = 'DNSCache'
        Path      = $_.Entry
        Size      = ''
        Modified  = ''
        SigStatus = $_.Data
        Signer    = ''
    }
}

$report | Export-Csv -Path "C:\Windows\Temp\trezor_assessment_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv" -NoTypeInformation
if ($report.Count -eq 0) { Write-Host "[+] No suspicious Trezor artifacts found." } else { Write-Host "[!] $($report.Count) items flagged — review the CSV." }

Remediation

For affected individuals (and employees who ordered Trezor devices):

1. Never enter your recovery seed anywhere. Trezor will never ask for it. Any email, SMS, website, or phone call requesting your 12/24-word seed is an attack — full stop. This single rule defeats the entire threat model of this breach.
2. Treat all "Trezor" communications as hostile by default. Navigate to trezor.io by typing it manually; never click links in wallet-related emails or texts. Verify Trezor Suite updates only through the official app or site.
3. Enable a passphrase (25th word) on the device if not already in use — it adds a layer that a harvested seed alone cannot defeat.
4. Harden exchange accounts: move from SMS 2FA to app-based TOTP or FIDO2 hardware keys, and ask your mobile carrier for a port-out/SIM-swap lock given the exposed phone numbers.
5. Watch for physical targeting. Home addresses are exposed; be alert to extortion letters or "in-person verification" scams.

For security teams (enterprise):

1. Brief your users now. A short, targeted advisory to staff about Trezor-themed phishing is cheap and timely — employees bring personal crypto risk into corporate inboxes.
2. Email gateway controls: add detections/impersonation rules for trezor display-name spoofing and lookalike domains; flag external mail with crypto-seed lures ("recovery seed," "verify your wallet," "suite update required").
3. DNS/web filtering: block newly registered domains containing trezor (and common typos) that are not trezor.io/satoshilabs.com; alert on resolution attempts per the Sigma rule above.
4. Application control: restrict execution of wallet software to signed binaries from known publishers; flag any *trezor* binary outside C:\Program Files\Trezor Suite.
5. Third-party risk management: this breach came through a logistics vendor, not the wallet maker. Inventory which of your vendors hold customer PII — fulfillment, marketing platforms, support ticketing (Trezor's 2024 breach was a support-ticket platform; its 2022 incident was Mailchimp) — and enforce data-minimization clauses. Ask: does your shipper really need phone numbers? Audit contractual breach-notification timelines; the gap between an August intrusion and expanded notification months later is exactly what your contracts should constrain.
6. If you suspect a user entered a seed on a phishing site: treat as an active incident — funds must be moved to a new wallet with a freshly generated seed immediately (time-to-theft is typically minutes to hours), and the endpoint should be triaged for clipper/stealer malware per the VQL hunt above.

There is no patch for a third-party PII breach — the remediation is detection discipline, user hardening, and vendor governance. The organizations that absorb this lesson cheapest are the ones that act before the phishing emails land.

Related Resources

Security Arsenal Incident Response Services AlertMonitor Platform Book a SOC Assessment incident-response Intel Hub