Three major crypto companies were breached within four days, leaving the data of 253,487 customers in the hands of hackers. SafePal, Trezor, and Bits of Gold were not hacked directly. The attacks entered through security gaps at the third-party vendors they use. What was leaked was not the seed phrase, but far more dangerous data: the physical home addresses of the crypto owners.
SafePal recorded that 39,798 of its customer data was leaked due to an authorization vulnerability in an order tracking plugin. This data included names, emails, phone numbers, shipping addresses, and purchase details between March 2, 2025, and April 11, 2026, without including private keys or bank details. Elsewhere, 13,689 customers of Trezor hardware wallets were exposed through fulfillment provider ShipMonk. Of that number, 11,742 users experienced full exposure, which included names, emails, phone numbers, and addresses.
Why These Attacks Occurred Simultaneously
Trezor and Bits of Gold - the largest crypto broker in Israel - were hit by the same vulnerability. Attackers exploited the CVE-2026-72898 flaw in the Metabase analytics tool. This is a critical SQL injection vulnerability with a CVSS rating of 10.0 located in the password reset endpoint.
Through this flaw, attackers injected SQL, took over admin access, and read all connected databases. Around 200,000 Bits of Gold users were also exposed, losing data including names, Israeli government ID numbers, IPs, bank account details, and public wallet addresses. Metabase confirmed that this exploit occurred before a fix patch was available. CISA immediately added this vulnerability to the Known Exploited Vulnerabilities catalog.
This threat remains widespread. Out of approximately 11,000 self-hosted Metabase instances scanned, 4,309 are potentially vulnerable. More than 97% of hosts running the affected versions have not yet received the fix patch.
Life-Threatening Physical Impact
The leak of verified home addresses opens the door to physical crime. CertiK’s report for the first half of 2026 recorded 52 ‘wrench attack’ incidents - physical violence to extort crypto assets. This figure is up 33% from 39 incidents in the same period last year. The resulting financial losses skyrocketed 11-fold, from $10.5 million to $124.1 million.
Home invasion cases linked to crypto theft also surged, from a single case in the first half of 2025 to 20 cases this year. In France, 41 crypto-related kidnapping cases were recorded throughout 2026, equivalent to an average of one occurrence every two and a half days.
Danger Patterns from the Back Door
The main pattern of these three leaks highlights a structural vulnerability in the crypto industry: customer security is compromised by vendor negligence. Users kept their wallets secure, but their physical data was handed over to hack-prone third parties.
In response, SafePal has already removed more than 30 related phishing sites and cut its customer data retention period to 90 days. But for the hundreds of thousands of people whose data has already leaked, physical threats are now a permanent risk. The crypto industry may succeed in securing your money, but they fail to secure your front door.
As reported by crypto.news.
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
