Trezor customers receive phishing letters with QR codes after shipping breach

After a breach at shipping partner ShipMonk, Trezor customers began receiving postal letters urging them to "migrate their wallets" via QR codes that lead to phishing sites built to steal seed phrases. The breach initially affected 13,689 customers and later grew to roughly 81,000 after older U.S. order records were found exposed.

• ShipMonk breach hit 13,689 customers, later expanded to about 81,000
• QR codes route via io-qr.cc to a lookalike domain registered September 3
• Trezor says its systems, devices and private keys were not compromised
• Only defense: never enter a seed phrase outside the hardware wallet itself