2026-08-20autoTrezor published an official 2026-08-13 blog naming ShipMonk as the breached fulfillment partner and restating 11,742 full-address records plus 1,947 partial; devices and firmware remain unaffected. After the first post, Trezor said the 1,947 partial cohort (name/city/email only) may include older-than-90-day orders…
2026-09-07Trezor disclosed that ShipMonk had kept records it was required to delete; about 67,000 additional US customers affected, bringing the total to roughly 81,000. Data exposed: names, shipping addresses, emails, phone numbers. Devices and firmware unaffected.
2026-09-11Separate breach at Brevo, Trezor's newsletter provider: about 347,000 subscribers received a phishing email titled "Critical Security Alert: STM32 Entropy Vulnerability"; about 2,500 clicked before the malicious site was taken offline roughly 20 minutes after detection.
2026-10-16autoNo new disclosure concerning the ShipMonk data breach or the Brevo phishing incident itself appeared in the last 7 days: Trezor's ShipMonk post still shows 80,689 affected customers (last updated 2026-09-04) and the Brevo post still shows 347,149 addresses (last updated 2026-09-17), with no resolution or new count.…
Solid pick. Verified working but with a meaningful caveat (UX rough, smaller market, intermediate trust step, partial coverage). Listed because the trade-off is sometimes worth it.
Rubric completo + recorrido de verificación de 7 pasos en /methodology.
veredicto editorial · conclusión
Veredicto del Curador y Análisis OpSec
CONCLUSIÓN
Trezor es un billetera Monero funcional y comprobado que rinde bien, siempre que se tengan presentes sus compromisos operativos.
✓
Puntos Fuertes
▸Arquitectura no custodial: el usuario mantiene el control total de sus claves privadas.
▸Código abierto: repositorios públicos que permiten auditoría y verificación comunitaria.
▸Trayectoria consolidada: prestando servicio continuo desde 2014 (12 años).
⚠
Advertencias y Riesgos OpSec
▸INCIDENTE ACTIVO (2026-08-13): A third-party shipping provider used by Trezor (ShipMonk) was breached, exposing full names, phone numbers, email addresses and shipping addresses. Trezor's first count (2026-08-13) was 11,742 customers with full exposure plus 1,947 partial; on 2026-09-07 it disclosed that ShipMonk had failed to delete older records as required, adding about 67,000 US customers and bringing the total to roughly 81,000. Separately, attackers compromised Brevo, the service Trezor uses for newsletters, and on 2026-09-11 sent about 347,000 Trezor subscribers a fake "Critical Security Alert: STM32 Entropy Vulnerability" email; about 2,500 people clicked before the phishing site was taken down roughly 20 minutes later. Trezor firmware and devices are not affected: both incidents sit in Trezor's vendors, not its hardware. The risk to readers is twofold: convincing phishing that now knows you own a Trezor, and home addresses of confirmed crypto holders circulating, which is a physical-safety problem, not just an inbox one.
▸Riesgo de KYC por alerta: las órdenes pueden ser retenidas para verificación si saltan los filtros automáticos.
▸Solo superficie clearnet: no ofrece espejo .onion oficial; expone la IP del usuario salvo uso de VPN/Tor.
Reseña
Trezor combinado con Monero GUI / Feather para firmar XMR. Firmware totalmente open source, builds reproducibles — el diferencial frente a Ledger. Compra con dirección de envío como las demás hardware, pero el uso del wallet es anónimo.
ASageSwap— Anonymous swap — no KYC, no AML hold, no IP logging, declines law-enforcement requests.→ 
xmr.club
CCE.Cash B ★ HEADLINE 
Xeovo VPN A ★ HEADLINE 
Trocador A ★ HEADLINE 
Cake Wallet A ★ HEADLINE 
DEX.fo B- ★ HEADLINE