TREZOR LEAK GROWS BY 67,000 BUYERS — HOME ADDRESSES, FROM RECORDS A VENDOR SWORE IN WRITING WERE DELETED — THE KEYS HELD, THE PAPERWORK DIDN’T

Trezor said this morning its shipping-vendor breach is much bigger than first reported: 67,000 more U.S. buyers, on top of 13,689 already disclosed — roughly 80,000 people. Names, emails, phone numbers, order numbers, and home addresses, from orders placed between November 2019 and August 2021. The devices did their job. No keys, no seed words, no firmware touched. The failure was upstream and it was procedural: the vendor, Shipmonk, confirmed in writing — more than once — that these records were deleted under a 90-day retention policy. They weren’t. Then an unknown flaw in the vendor’s analytics tool walked them out the door. This is the third time Trezor buyers have been exposed by someone else’s database — 106,000 in 2022, 66,000 in 2024 — and the company’s answer, locker pickup and auto-deleted shipping records, concedes the point the Technologist has made for years: the database was the defect. A list of names, home addresses, and confirmed hardware-wallet ownership is not a phishing risk. It is a target list. The rule stands: no one from any wallet company will ever ask for your seed words. No one.