Between 13 and 16 August 2026, three crypto companies disclosed customer data breaches. Their combined exposure is 253,487 individuals.
None of the three was actually breached. In every case the attacker went through a third party the company had contracted with — a fulfilment provider, an analytics platform, an order-tracking plugin — and in two of the three cases through the same vulnerability.
The compromised data contains no private keys and no funds. It is worse than that. It is a verified list of people who own cryptocurrency, with their names and home addresses attached.
What Happened
SafePal — disclosed 16 August. An authorisation flaw in a third-party order-tracking plugin exposed 39,798 customers who placed orders between 2 March 2025 and 11 April 2026. Names, email addresses, phone numbers, shipping addresses, purchase details. No seed phrases, no keys, no funds.
Trezor — via fulfilment partner ShipMonk. 13,689 customers: 11,742 with full details exposed, 1,947 partially.
Bits of Gold — Israel’s largest regulated crypto broker, disclosed 16 August. Roughly 200,000 customers via a breached analytics vendor. Names, Israeli national ID numbers, emails, phone numbers, IP addresses, bank account details, and public wallet addresses. No funds, keys, passwords, CVV data, or scanned ID documents.
Two of the three — ShipMonk and the Bits of Gold analytics platform — trace to the same root cause.
CVE-2026-72898
CVE-2026-72898 is an unauthenticated SQL injection in Metabase, the open-source business-intelligence tool. It is rated CVSS 10.0 — the maximum.
The flaw lets a remote attacker inject SQL through the password-reset endpoint, without credentials, and pivot to administrative access over every database Metabase is connected to. That last clause is the whole problem. Metabase is a dashboard layer; organisations deliberately point it at their most complete data stores. Compromising it does not yield a slice of data, it yields the join.
At the time of the advisory, more than 97% of fingerprinted self-hosted instances on affected branches appeared unpatched.
That number explains the four-day cluster. This was not a campaign against crypto companies. It was almost certainly indiscriminate scanning for a trivially exploitable maximum-severity bug in widely deployed software — and crypto vendors were simply among the hosts that answered. The clustering is a scanning artefact, not targeting.
Which means the disclosures so far are the ones that noticed.
Why Shipping Addresses Are the Dangerous Field
The standard breach-response line is that no funds or keys were compromised, so exposure is limited to spam and phishing risk. For a hardware wallet customer list, that reasoning does not hold.
A hardware wallet purchase record is a proof of crypto ownership tied to a physical address. It is not an inference from a leaked email list. The person bought a device whose only purpose is storing cryptocurrency, and told the seller where they live.
CertiK’s data on physical-coercion attacks — “wrench attacks” — for the first half of 2026:
| Metric | H1 2025 | H1 2026 |
|---|---|---|
| Verified incidents | 39 | 52 (+33%) |
| Financial exposure | $10.5M | $124.1M |
| Home invasions | 1 | 20 |
Home invasions went from a single case to twenty in twelve months, and exposure rose almost twelvefold. France alone accounts for 33 of the 52 incidents — 63.5%.
The operational bottleneck for that crime has always been target selection: knowing which household holds meaningful crypto and where it is. Address-linked purchase records solve exactly that problem. As the reporting on this cluster put it plainly — the attacker does not need to guess who owns crypto; the breach confirms it.
Bits of Gold’s exposure is worse again. National ID numbers plus bank details plus public wallet addresses means an attacker can look up the on-chain balance associated with a named, addressable individual. That is not a mailing list. That is a ranked target list.
The Pattern This Belongs To
We wrote after the Coldcard entropy failure that self-custody carries a vendor-concentration tail — that five thousand people who each believed they held an independent key in fact held shares in one firmware build.
This is the same structural point from the other direction. You can hold your keys perfectly and still be enumerated, because the purchase of self-custody is a custodial event. Somewhere in the supply chain, a company you never contracted with is holding a record that says you own crypto and here is your front door.
And as we noted in the July recap, 2026’s losses break down overwhelmingly into human, operational and supply-chain failures rather than smart-contract logic bugs. Every one of these three companies had security programmes. None of the programmes covered the thing that failed, because the thing that failed was outside the boundary they were scoped to defend.
Vendor risk is not a compliance checkbox in this industry. It is the primary attack surface, and it is the one nobody’s threat model owns.
Responses
Trezor announced an Anonymous Delivery service — device delivery without an address on file — launching in the EU in September 2026 and the US by year-end.
That is the correct structural fix: data that is never collected cannot be leaked by a vendor you have never heard of. It is also an admission that the current model was collecting information it could not protect.
What to Do
If you bought a hardware wallet from any vendor, ever:
- Assume your address is or will be in a breach corpus. Treat it as a standing condition, not an incident.
- Do not discuss holdings in any identifiable context. Target selection is the attacker’s hard problem; social media does more of that work than any breach.
- Set up a duress wallet — a decoy with a plausible balance, reachable with a separate passphrase. Against physical coercion this is the only control that functions, because every cryptographic control assumes you are not being compelled.
- Consider geographic separation of seed backups. A home invasion that finds the device and the backup is a total loss; one that finds only the device is not.
- Use address-free delivery, package lockers, or a business address for future purchases.
If you run a crypto business:
- Inventory every third party holding customer PII, including plugins. SafePal’s exposure came through an order-tracking plugin — the kind of integration that is added once and never re-reviewed.
- Patch Metabase now, and audit what any self-hosted BI tool is connected to. At 97% unpatched, the base rate says you are exposed.
- Reconsider retention. SafePal’s breach covered orders back to March 2025. Shipping records that old have no operational purpose and unbounded liability.
- Minimise at collection. Every field you do not store is a field no vendor can lose.
The industry has spent a decade hardening the cryptography and the contracts. Both are now, broadly, the strongest parts of the stack. The weak part is a fulfilment vendor’s unpatched dashboard — and a list of names and addresses that turns a financial exposure into a physical one.
Sources: crypto.news — shipping leaks fuel wrench attacks · CoinDesk — Bits of Gold breach · CryptoSlate — SafePal breach · Gizmodo — SafePal exposes 39,798 customers
