This pattern mirrors a broader trend in logistics-targeted cyberattacks. Earlier this month, a breach at CEVA Logistics exposed shipping data for customers of Valve, Bol, ING, and Ajax across eight European warehouses. Valve subsequently warned Steam hardware buyers to expect phishing attempts quoting their exact home addresses and order details. In both cases, the compromised logistics partners retained shipping data for up to 90 days after fulfillment, limiting the blast radius to recent purchasers.
ShipMonk, a Fort Lauderdale-based third-party logistics provider that raised a $290 million Series C in 2021, has faced mounting operational scrutiny in recent months. Trade publications have reported rumored rate hikes of 12% to 18% for some merchants, a quiet CFO departure in June or July, and alleged staffing turmoil at its Miami fulfillment hub. The company acquired Whiplash in late 2023 and spent 2024 and 2025 consolidating warehouse operations onto a unified warehouse management system.
For Trezor users, the immediate concern is social engineering. The hardware wallets themselves remain secure; private keys never leave the device, and no remote exploit of Trezor firmware has ever been documented. However, the breach underscores a structural vulnerability in the crypto hardware supply chain: the physical fulfillment layer sits outside the manufacturer's direct security perimeter, yet holds enough personal data to enable targeted attacks on the very customers the devices are designed to protect.