Hardware wallet manufacturer Trezor has disclosed a data breach affecting nearly 14,000 customers — not because Trezor's own infrastructure fell, but because its shipping and logistics provider, ShipMonk, was compromised. The exposed data is customer PII tied to hardware wallet purchases: names, shipping addresses, email addresses, and related order details. No wallet seeds, private keys, or funds were directly exposed — Trezor devices and the Trezor Suite application were not compromised.
Do not let that distinction create complacency. This is the exact class of breach that produces the most dangerous downstream attacks in the cryptocurrency ecosystem. A verified list of known hardware wallet owners, with home addresses and contact details, is a targeting list. Historically, breaches of this type (Ledger's 2020 e-commerce breach being the canonical example) were followed by years of spear phishing, fake firmware update campaigns, SIM-swapping, extortion, and in some cases physical threats against holders. Defenders — whether protecting affected employees, executives, or customers — need to treat this as the beginning of a campaign, not the end of an incident.
Technical Analysis
What happened
- Affected entity: ShipMonk, a third-party shipping and logistics/fulfillment provider used by Trezor.
- Affected population: Nearly 14,000 Trezor customers whose orders were processed through ShipMonk.
- Data exposed (per disclosure): Customer PII associated with order fulfillment — names, postal addresses, email addresses, and order-related metadata. Payment card data and wallet cryptographic material were not impacted.
- Attack chain (defender's view):
- Threat actor gains access to ShipMonk's environment (initial access vector not publicly detailed at disclosure).
- Actor identifies and exfiltrates customer/order records for high-value clients — Trezor's customer base being an obvious target given the guaranteed intersection with cryptocurrency ownership.
- Stolen PII is weaponized for second-order attacks: phishing impersonating Trezor (fake "security incident, verify your wallet" lures), distribution of trojanized "Trezor Suite" installers, SIM-swap pretexting using verified name/address data, and physical-address-based extortion.
CVE / exploitation status
No CVE has been assigned to this incident — it is a third-party operational breach, not a disclosed software vulnerability. There is no vendor patch to apply. The "exploitation" phase that matters to defenders is the post-breach abuse of the leaked dataset, which based on historical precedent begins within days to weeks of disclosure and persists for years.
Why this dataset is uniquely dangerous
Unlike a generic PII dump, this list answers an attacker's most expensive question: who actually holds self-custodied crypto worth stealing? Every record is a pre-qualified victim. Expect:
- Credential/seed phishing — emails and SMS impersonating Trezor, citing the breach itself as urgency ("confirm your recovery seed to secure your funds" — Trezor will never ask for a seed phrase).
- Malware delivery — fake Trezor Suite "security updates" delivering stealers or clipboard hijackers.
- SIM swapping — leaked name/address/phone used to pass carrier identity verification, then intercept 2FA on exchanges.
- Physical risk — home addresses of known holders enable "wrench attack" extortion; high-net-worth affected individuals should be advised accordingly.
Detection & Response
The breach itself occurred inside ShipMonk's environment — outside your telemetry. What you can detect is the weaponization phase inside yours. The detections below target the two highest-fidelity downstream behaviors: (1) lookalike-domain phishing infrastructure impersonating Trezor, and (2) execution of trojanized wallet software. They are deliberately scoped to avoid noise — a rule that fires on every email containing the word "Trezor" would be disabled in a week.
---
title: DNS Query to Trezor Lookalike Domain
description: Detects DNS resolution of domains containing 'trezor' that are not official Trezor infrastructure. Post-breach phishing campaigns impersonating Trezor (fake firmware updates, seed-harvesting pages) rely on lookalike domains. Tune the exclusion list to your org's legitimate usage.
id: 3f8c1a92-7b2d-4e51-a9c6-5d1e8f3a7b42
status: experimental
references:
- https://www.bleepingcomputer.com/news/security/trezor-discloses-data-breach-affecting-nearly-14-000-customers/
- https://attack.mitre.org/techniques/T1566/002/
author: Security Arsenal
date: 2026/02/10
tags:
- attack.initial_access
- attack.t1566.002
logsource:
category: dns
detection:
selection:
query|contains: 'trezor'
filter_official:
query|endswith:
- 'trezor.io'
- 'trezor.com'
- 'satoshilabs.com'
condition: selection and not filter_official
falsepositives:
- Legitimate regional/CDN Trezor domains not yet in the exclusion list
- Security researchers and threat intel tooling
level: high
---
title: Execution of Suspect Trezor-Branded Installer from User Directory
id: 9a2e4c71-3d6f-4b18-a5e2-8c7f1b9d4e63
status: experimental
description: Detects execution of binaries masquerading as Trezor Suite or Trezor firmware tools launched from user-writable locations (Downloads, Temp, AppData). Fake wallet-update malware distributed via post-breach phishing commonly uses Trezor branding and lands in these paths.
references:
- https://www.bleepingcomputer.com/news/security/trezor-discloses-data-breach-affecting-nearly-14-000-customers/
- https://attack.mitre.org/techniques/T1204/002/
author: Security Arsenal
date: 2026/02/10
tags:
- attack.execution
- attack.t1204.002
- attack.t1036
logsource:
category: process_creation
product: windows
detection:
selection_name:
Image|contains:
- '\Downloads\'
- '\Temp\'
- '\AppData\Local\Temp\'
- '\AppData\Roaming\'
Image|contains: 'trezor'
selection_cli:
CommandLine|contains: 'trezor'
CommandLine|contains:
- 'update'
- 'firmware'
- 'recovery'
- 'verify'
condition: selection_name or (selection_cli and selection_name)
falsepositives:
- Users manually running the genuine Trezor Suite installer from Downloads — validate Authenticode signature (should be signed by SatoshiLabs) before escalating
level: high
The first rule is intentionally anchored on DNS with an explicit allowlist: any resolution of a trezor-containing domain that isn't official infrastructure is, in an enterprise environment, almost always worth an analyst's eyes. The second targets the masquerading behavior (T1036) rather than a specific hash, since phishing-crew payloads rotate hashes daily.
// Hunt: Email delivery and URL clicks referencing Trezor from non-official senders
// Covers the phishing wave that historically follows hardware-wallet PII breaches.
// Requires Microsoft 365 Defender (EmailEvents / UrlClickEvents).
let officialSenders = dynamic(["trezor.io", "satoshilabs.com"]);
let lookback = 30d;
let suspiciousMail =
EmailEvents
| where Timestamp > ago(lookback)
| where Subject has_any ("trezor", "wallet", "firmware", "recovery phrase", "seed")
or BodyPreview has "trezor"
| where not (SenderFromDomain has_any (officialSenders))
| project Timestamp, NetworkMessageId, SenderFromAddress, SenderFromDomain,
RecipientEmailAddress, Subject, ThreatTypes, DeliveryAction;
suspiciousMail
| join kind=leftouter (
UrlClickEvents
| where Timestamp > ago(lookback)
| where Url has "trezor" and not (Url has_any ("trezor.io", "satoshilabs.com"))
| project ClickTime=Timestamp, NetworkMessageId, Url, AccountUpn, IsClickedThrough
) on NetworkMessageId
| extend ClickedToLookalike = isnotempty(Url)
| order by Timestamp desc
Analysts should escalate any row where ClickedToLookalike == true — a user clicking through to a Trezor lookalike domain after receiving breach-themed lures is a high-probability seed-harvesting or malware event. For organizations without M365 email tables, the same logic ports to proxy logs in CommonSecurityLog by filtering RequestURL contains "trezor" minus official domains.
-- Velociraptor hunt: find suspect Trezor-branded executables in user-writable
-- locations across the fleet, with signature metadata for triage.
-- Post-breach campaigns commonly push fake 'Trezor Suite' updaters.
LET hits = SELECT
FullPath,
Size,
Mtime AS Modified,
hash(path=FullPath) AS Hashes
FROM glob(globs=[
'C:/Users/*/Downloads/*trezor*',
'C:/Users/*/AppData/Local/Temp/*trezor*',
'C:/Users/*/AppData/Roaming/*trezor*',
'C:/Users/*/Desktop/*trezor*'
], accessor='ntfs')
WHERE NOT IsDir
SELECT FullPath, Size, Modified,
Hashes.SHA256 AS SHA256,
authenticode(filename=FullPath) AS Signature
FROM hits
Triage the output by Signature: genuine Trezor Suite binaries carry a valid Authenticode chain to SatoshiLabs. Unsigned, invalidly signed, or self-signed Trezor-branded binaries in these paths warrant immediate host isolation and memory capture — clipboard-hijacker and stealer payloads are the standard payload in these campaigns.
# Trezor-Breach Post-Exposure Audit — run on endpoints used by crypto-holding staff.
# 1) Inventory installed software branded 'Trezor' and verify Authenticode signature.
# 2) Flag recently created Trezor-branded files in user-writable paths.
# 3) Report hosts with LSA/credential-guard gaps relevant to stealer payloads.
$report = [System.Collections.Generic.List[object]]::new()
# --- 1) Installed Trezor-branded software + signature validation ---
$paths = @(
'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*',
'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*'
)
Get-ItemProperty $paths -ErrorAction SilentlyContinue |
Where-Object { $_.DisplayName -match 'trezor' } |
ForEach-Object {
$exe = Join-Path $_.InstallLocation 'Trezor Suite.exe' -ErrorAction SilentlyContinue
$sig = if (Test-Path $exe) { Get-AuthenticodeSignature $exe } else { $null }
$report.Add([pscustomobject]@{
Check = 'InstalledSoftware'
Item = $_.DisplayName
Path = $_.InstallLocation
SigStatus = $sig.Status
Signer = $sig.SignerCertificate.Subject
Suspicious = ($sig.Status -ne 'Valid' -or $sig.SignerCertificate.Subject -notmatch 'SatoshiLabs')
})
}
# --- 2) Recently created Trezor-branded files in user-writable locations ---
$userDirs = Get-ChildItem 'C:\Users' -Directory | ForEach-Object {
@("$($_.FullName)\Downloads", "$($_.FullName)\Desktop", "$($_.FullName)\AppData\Local\Temp")
}
foreach ($dir in $userDirs) {
if (Test-Path $dir) {
Get-ChildItem $dir -Recurse -Filter '*trezor*' -ErrorAction SilentlyContinue |
Where-Object { $_.CreationTime -gt (Get-Date).AddDays(-30) -and -not $_.PSIsContainer } |
ForEach-Object {
$sig = Get-AuthenticodeSignature $_.FullName
$report.Add([pscustomobject]@{
Check = 'RecentFile'
Item = $_.Name
Path = $_.FullName
SigStatus = $sig.Status
Signer = $sig.SignerCertificate.Subject
Suspicious = ($sig.Status -ne 'Valid')
})
}
}
}
$report | Format-Table -AutoSize
$report | Where-Object Suspicious | Export-Csv ".\trezor_audit_$(hostname)_$(Get-Date -f yyyyMMdd).csv" -NoTypeInformation
Any row flagged Suspicious — especially a "Trezor Suite" installation not signed by SatoshiLabs — should trigger your standard malware IR playbook: isolate, capture triage image, rotate exchange credentials and any credentials used on that host, and check for clipboard-replacement and browser-credential-access artifacts.
Remediation
There is no patch — remediation here is exposure management and user protection.
For affected individuals (communicate this clearly):
- Never enter a recovery seed anywhere. Trezor will never ask for it via email, phone, SMS, or a website. Any such request is an attack, full stop.
- Treat all unsolicited Trezor-branded communication as hostile. Navigate only by typing
trezor.iodirectly; never click links in breach-notification emails claiming to require "wallet verification." - Only download Trezor Suite from the official site and verify the PGP/signature per Trezor's documented verification procedure before installing.
- Move exchange account 2FA off SMS to hardware keys (FIDO2) or TOTP; contact mobile carriers to place port-out/SIM-swap locks — leaked name+address+phone data is sufficient pretexting material for many carriers.
- Be alert to physical-mail and phone-based extortion referencing the shipment address; report threats to law enforcement.
- Expect this dataset to resurface for years — brief affected users that vigilance is long-term, not a 30-day exercise.
For security teams:
- Identify affected personnel (execs and staff who ordered Trezor devices to corporate or home addresses) and deliver targeted anti-phishing briefings — generic awareness training will not land; personalized briefings will.
- Deploy the detections above; add
trezor-lookalike domain alerting to your DNS sinkhole/secure web gateway and block newly registered domains containing the string at the proxy. - Review third-party/vendor risk posture: this breach originated in a logistics provider, not the wallet vendor. Inventory which of your vendors (and your vendors' vendors) hold customer PII, and validate contractual breach-notification SLAs and data-minimization clauses. Ask: did the fulfillment partner need to retain this data at all?
- Incorporate this scenario into tabletop exercises: "a supplier leaks a list of our crypto-holding executives" is now a documented, real-world threat pattern.
- Monitor Trezor's official disclosure channels and the BleepingComputer coverage for updates on scope and initial-access vector; if ShipMonk's intrusion vector is later attributed to a specific vulnerability, reassess your own exposure to that stack.
Related Resources
Security Arsenal Red Team Services AlertMonitor Platform Book a SOC Assessment pen-testing Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.