Trezor data breach reignites debate over crypto holders' physical safety

The recent data breach at a delivery partner used by Trezor has once again sparked debate over a sensitive problem in the crypto world: what happens when a crypto holder’s name and home address leak out? The situation strongly echoes the major Ledger data breach of 2020. Six years on, some affected Ledger customers are still receiving phishing messages and suspicious phone calls, while France has seen a sharp rise in physical attacks linked to crypto.

Ledger data breach from 2020 remains relevant

At Trezor, the data of 13,689 customers was recently exposed via logistics partner ShipMonk. For 11,742 people, this included their full name, phone number, email address and shipping address.

Although the hardware wallets themselves remain secure, it is precisely this kind of personal information that can be dangerous. A malicious actor could infer from the data that a hardware wallet was delivered to a particular address and that the recipient may therefore hold crypto.

The situation is reminiscent of Ledger. In 2020, a company database was stolen and later appeared publicly online. Ultimately, around 272,000 records containing names, phone numbers and physical addresses were leaked, and more than one million email addresses were also affected.

The consequences do not stop when the breach drops out of the news. Leaked databases can be copied endlessly, and Ledger customers report phishing attempts and suspicious phone calls years later. You can change a password, but moving house because your home address has been leaked is quite another story.

Physical attacks make the risk more concrete

That danger carries extra weight given recent violent incidents in France. According to figures cited in the debate, French authorities recorded 77 cases of kidnapping, extortion, unlawful deprivation of liberty and attempted offences linked to crypto in the first half of 2026.

Chainalysis also sees a rise. The number of documented attacks in France is said to have increased from an average of 1.9 per month in 2025 to 4.6 per month in the first half of 2026. The share of home invasions within violent crypto incidents climbed from 14% to 37%.

Family members are also being targeted. More than 40% of the French incidents reportedly involve a family member or other acquaintance of the crypto holder.

How serious this can become is clear from earlier cases. Ledger co-founder David Balland and his partner were kidnapped from their home in January 2025, with Balland mutilated in the attack. A few months later, the father of a crypto entrepreneur was abducted and held for more than two days, during which the perpetrators cut off part of his finger.

Ten-year retention period raises questions

Against that backdrop, criticism has also emerged over the way Ledger stores customer data. According to its privacy policy, Ledger collects names, email addresses, shipping and billing addresses, phone numbers and order details.

Ledger says data is retained for ten years because of legal obligations and archived three months after an order is completed. That raises the question of which personal data genuinely needs to be kept for ten years, and whether phone numbers and shipping addresses could be deleted sooner.

The discussion has become more pressing after Ledger customers were hit again in January 2026 by an incident at external e-commerce partner Global-e. Contact details and order information were exposed once more.

Trezor, meanwhile, is taking a different approach. Following the recent ShipMonk breach, the company is working on Anonymous Delivery, which would allow customers to receive their hardware wallet via a parcel locker without linking their usual home address to the order.