Back in July, when ZachXBT called every hardware wallet on the market “complete garbage,” the crypto community pushed back hard.
Fast forward to September, and Trezor just quietly confirmed that a breach it originally described as affecting roughly 13,700 people actually touches more than 80,000, with some of the exposed records nearly seven years old. I don’t think “insane prophecy” is an exaggeration at this point, it’s starting to look like the most accurate hot take of the year.
What Trezor Actually Is, For Anyone New To This Story
Before getting into how bad this has gotten, it’s worth grounding this in what Trezor actually is. Trezor, made by Czech company SatoshiLabs, is widely credited as the very first hardware wallet ever brought to market, letting users store crypto private keys on a physical, offline device rather than on an internet-connected computer or exchange. That’s the entire value proposition of a hardware wallet: even if your laptop is compromised, your keys, and by extension your funds, stay isolated on a separate piece of hardware. It’s precisely because Trezor has spent over a decade building trust around that promise that a breach involving customer data, rather than the wallets themselves, lands as hard as it does.
The Original Breach, And Why It Just Got So Much Worse
Trezor first disclosed this incident on August 13, confirming that its shipping provider, ShipMonk, had suffered unauthorized access to systems holding customer order data after attackers exploited a vulnerability in a third-party analytics platform. At the time, the company said roughly 13,689 customers were affected, split between 11,742 with full exposure, meaning name, email, phone number, and shipping address and 1,947 with more limited exposure covering name, city, and email.
That number just exploded. In an update posted directly to Trezor’s official social channels, the company revealed that another 67,000 US customers who ordered between November 2019 and August 2021 were also affected, with their full details, name, email, phone number, shipping address, and order number, exposed in the same breach. That brings the total number of known affected customers to well over 80,000, and pushes the age of some exposed records back nearly seven years, far beyond what anyone would reasonably expect a shipping partner to still be holding.
Trezor’s Own Frustration With ShipMonk Is Genuinely Notable
What I think deserves real attention here is how directly Trezor called out its own vendor. The company said that throughout its entire relationship with ShipMonk, it had repeatedly requested and received written assurance confirming that customer data had been deleted, in line with its contract, its data policy, and prior communications. Despite that written confirmation, the data was never actually deleted from ShipMonk’s systems.
I think that detail changes the framing of this entire story. This isn’t simply a case of a vendor getting hacked; it’s a case of a vendor apparently telling a security-focused company exactly what it wanted to hear, on paper, while the underlying practice never matched the promise. Trezor was blunt about its own reaction, saying plainly that it’s very disappointed given the assurances it had received. For a company whose entire brand rests on verifiable trust, discovering that a written compliance confirmation didn’t reflect reality is a genuinely serious problem, and one that sits well outside Trezor’s own direct control.
What Wasn’t Touched, And What Users Actually Need To Watch For
To Trezor’s credit, the company was consistent and clear about the boundaries of this breach. Its own systems were not compromised, and no device, private key, or wallet backup was ever at risk, since none of that information ever touches a shipping provider’s systems in the first place. What’s exposed is purely identifying and contact information, which sounds less severe until you consider exactly what that data enables.
Trezor specifically warned affected users to stay alert for fake emails, phone calls, and fraudulent letters, and flagged something genuinely more unsettling than typical phishing: potential risks to physical security. A verified list of names paired with home addresses and confirmation that the person owns a hardware wallet is precisely the kind of dataset that’s valuable to attackers running targeted scams or, in the worst cases, physical intimidation and theft attempts, rather than generic phishing blasted at random inboxes. The company reiterated the one rule that matters most regardless of what data was exposed: never share your wallet backup with anyone, and never type it into a website, under any circumstance.
ZachXBT’s July Warning Reads Very Differently Now
This is where the story circles back to where it started. In July, ZachXBT posted what he called a hot take on his Telegram investigations channel, arguing that hardware wallets in their current form are complete garbage and shouldn’t be trusted for critical tasks like signing transactions or storing serious funds. He specifically suggested that a dedicated, separate device used exclusively as a signing tool would be safer, and he singled out Ledger by name as the worst offender, criticizing its frequent app and UI updates for regularly breaking simple, previously reliable actions.
At the time, that take was controversial enough to draw real pushback from a community that generally treats hardware wallets as the gold standard of crypto security. Reading it again now, against a backdrop of Trezor’s breach nearly sextupling in scope within a single month, it reads less like an overheated opinion and more like an early warning that the industry’s biggest names weren’t handling third-party risk nearly as carefully as their marketing suggested.
A Rough Stretch For Nearly Every Major Hardware Wallet Brand
I don’t think Trezor’s situation exists in isolation, and that context matters for understanding just how widespread this problem has become. Ledger, the brand ZachXBT specifically called out, is currently facing a proposed class action lawsuit filed August 27 in the Southern District of New York, seeking at least $500 million in damages tied to a December 2023 breach the plaintiff says led to nearly $2 million stolen from his wallet after Ledger allegedly failed to adequately warn affected users. That follows a separate Ledger data exposure disclosed in January 2026, when its third-party payment processor Global-e suffered unauthorized access to customer order records, exposing names and contact details in a pattern strikingly similar to what’s now happened to Trezor.
Beyond the two biggest names in the space, Coldcard suffered a major key-generation/entropy exploit that let attackers drain roughly $40–88 million in Bitcoin from affected wallets, and SafePal confirmed its own data breach in August, also tied to an order-tracking system rather than the wallets themselves, affecting nearly 40,000 customers. Taken together, that’s four major hardware wallet brands disclosing serious security incidents within a tight window, each pointing back to the same underlying weakness: not always the cryptographic security of the devices themselves, but the third-party vendors, shippers, payment processors, and analytics platforms sitting around them, holding exactly the kind of customer data that turns a security-conscious buyer into a highly specific, highly valuable target.
Disclosure: This is not trading or investment advice. Always do your research before buying any cryptocurrency or investing in any services.
Follow us on Twitter @themerklehash to stay updated with the latest Crypto, NFT, AI, Cybersecurity, and Metaverse news!