Trezor scams jumped noticeably after a shipping partner exposed personal data belonging to more than 13,000 customers in August 2026. If you own a Trezor, or you’re about to buy one, that breach is a useful reminder of where the real risk sits. It isn’t the device.
Trezor hardware wallets keep private keys offline, and no one has demonstrated a remote way to extract funds directly from one. The risk is you, specifically the moment someone convinces you to hand over your recovery seed outside of the device itself. Every scam on this list works the same way: it tries to get you to do that one thing.
Why Trezor Owners Have Become a Bigger Target
ShipMonk, a Trezor shipping partner, exposed order data for roughly 13,689 customers between May 10 and August 8, 2026, according to BeInCrypto, including names, emails, phone numbers, and addresses for 11,742 of them.
Trezor’s servers and private keys were untouched, but a scammer doesn’t need your key when they already know your address and that you just bought a hardware wallet. SafePal, a rival wallet maker, disclosed a nearly identical breach days later, proof that shipping partners have become a soft spot industry-wide. BitPinas reported that Trezor plans an “Anonymous Delivery” option to cut this exposure going forward.
The 7 Trezor Scams Making the Rounds Right Now
None of the tactics below require breaking into a Trezor device. Every one of them relies on convincing the owner to do something the hardware wallet was specifically designed to prevent: type a recovery seed anywhere other than the device’s own screen.
1. Phishing Built Around the ShipMonk Breach
Once a scammer has your name, address, and phone number, they can reference real order details to make an email, text, or call sound legitimate. BeInCrypto reported that phishing ads referencing Trezor were already running before the breach was publicly disclosed, and similar fake support calls have drained millions from holders this year. Watch for messages that name your recent purchase and push you toward a link claiming your device needs “verification.”
2. Fake Trezor Support Emails, Calls, and AI Voice Clones
Trezor’s own knowledge base warns that scammers now use AI to imitate official support in text, voice, and even video. This isn’t new: a 2024 breach affecting nearly 66,000 customers already fueled impersonation attempts, and Trezor separately confirmed hackers hijacked its contact form to send scam replies disguised as genuine support. The company’s own rule is blunt: any request for your wallet backup, PIN, password, or two-factor code is a scam, no matter how professional it sounds.
3. Physical Mail Letters Demanding an “Authentication Check”
In February 2026, Trezor and Ledger customers began receiving physical letters demanding a mandatory “Authentication Check,” complete with holograms and a QR code, warning the device would be restricted if a deadline was missed, according to Cointelegraph.
One letter was signed with the name of Trezor’s real CEO, Matěj Žák, and the QR code led to a fake setup page that asked for a recovery seed, sent straight to the attacker. Cyvers CEO Deddy Lavid told Cointelegraph that fear-based tactics like this tend to increase, not fall off, when the market gets shakier.
Understanding what a seed phrase protects in the first place, covered in our guide to seed phrases and wallet security, makes a request like this look obviously wrong on sight.
4. Counterfeit or Pre-Tampered Devices from Unofficial Sellers
Buying a hardware wallet secondhand or through a resale marketplace opens the door to a device compromised before it ever reaches you. Security researchers have documented buyers losing millions after purchasing a “factory-sealed” cold wallet through social commerce platforms, only to find the private key had already been generated by the seller.
A Trezor bought outside the official store carries this same risk no matter how convincing the packaging looks, so order directly from Trezor’s official store or a retailer Trezor names on its own site, and never accept a device that arrives already opened.
5. Fake Firmware Update Prompts
Trezor’s knowledge base lists fake firmware as one of the standing threats its hardware defends against. In this scam, a pop-up, email, or fake app screen urges you to install an “urgent” firmware update through an outside link rather than through Trezor Suite.
Real updates are verified cryptographically by the device and only ever initiated from within Trezor Suite itself, so anything asking otherwise should be treated as fraudulent by default.
6. Social Media Giveaway and Impersonation Scams
Trezor has warned that scammers impersonate exchanges, rival wallet brands, and even its own team members on social media, often dangling a giveaway or urgent account fix in exchange for a small crypto deposit or wallet connection.
These accounts can look identical to the real thing, down to the profile photo and post history. No legitimate giveaway ever asks you to send crypto first, and no real Trezor employee will message you asking for wallet access.
7. Evil Maid Attacks on an Unattended Device
This one is physical rather than digital. Trezor’s own documentation describes “evil maid” attacks, where brief physical access to an unattended device, say while you step away from your desk or hotel room, is enough to install malicious firmware.
It’s a low-probability scenario for most casual holders, but it’s why Trezor devices ship with tamper-evident packaging and PIN protection, and why leaving a device unattended in a shared space is worth avoiding if you’re holding a meaningful amount.
The One Habit That Stops Almost Every Scam on This List
Trezor’s own guidance cuts through all seven scenarios with one rule: never enter your wallet backup on a website or share it with anyone, no matter who’s asking. Every scam above fails the moment you follow it.
The habits covered in our guide to avoiding crypto wallet mistakes apply just as directly to Trezor owners as to anyone holding funds in a software wallet, since the underlying mistake in almost every case is the same: exposing a seed phrase somewhere it was never meant to go.
Frequently Asked Questions
Still unsure whether something you received is real? These are the questions Trezor owners are asking most after the recent breach.
Will Trezor ever call, email, or write to me asking for my recovery seed?
No. Trezor has stated directly that it will never ask for a wallet backup by any channel, including email, phone, web form, or postal mail. Any message asking for those 12 or 24 words, regardless of how official it looks, is a scam.
How do I know if my information was part of the ShipMonk breach?
Trezor emailed every affected customer directly from help@trezor.io following the August 2026 disclosure. If you ordered a device between May 10 and August 8, 2026 and did not receive that specific email, your data was not part of this particular incident.
Is it still safe to use my Trezor if my shipping data was exposed?
Yes. The breach affected order and delivery information held by a shipping partner, not Trezor’s servers, your device, or your private keys. The device itself remains secure. The added risk is targeted phishing using your exposed personal details, not a compromise of your funds.
What should I do if I already entered my seed phrase somewhere I shouldn’t have?
Move your funds immediately. Set up a brand-new wallet with a freshly generated seed phrase on a trusted device, then transfer everything from the old wallet to the new one as fast as possible, since anyone with the old phrase can drain it at any time.
Are counterfeit Trezor devices a real risk?
They’re common enough to take seriously, particularly when devices are bought secondhand or through informal resale channels rather than an official retailer. A tampered device can look factory-sealed and function normally during setup, which is exactly what makes this scam effective.
Your Next Step
If the ShipMonk breach has you second-guessing your setup, the highest-value move isn’t panic, it’s verification. Check whether help@trezor.io emailed you directly, confirm your device was bought through an official channel, and apply the one rule that defeats every scam above: nobody, ever, gets your seed phrase.
