Originally published on ColdCaseTech .

Disclosure: this post contains affiliate links. We may earn a commission at no extra cost to you.

Then vs. Now (Escalated): Then: Trezor disclosed on August 13, 2026 that a breach at its shipping partner ShipMonk exposed customer names, addresses, phone numbers and emails. Now: Some Trezor customers have received postal letters urging them to 'migrate their wallets' via QR codes that redirect to phishing sites built to steal seed phrases, and the breach's scope has grown to roughly 81,000 customers.

Trezor initially reported on August 13, 2026 that a breach at its shipping partner ShipMonk exposed the names, shipping addresses, phone numbers and email addresses of 13,689 customers (11,742 with full exposure, 1,947 with partial exposure), raising concerns about physical-mail and "wrench" attacks on crypto users. In early September, Trezor said the impact had grown to roughly 81,000 customers after older U.S.…