A French family was tied up for hours by attackers after their crypto. Police have not said how the attackers chose the house, and that gap is where the industry’s data problem lives.
At around 4 a.m. on September 20, four hooded men forced their way into a family home in northern France. They bound the parents and two children with black tape and forced the father to hand over his access codes and move 40,000 euros.
The father is a salaried IT worker in the crypto industry. Prosecutors have not said yet how the attackers identified him.
A separate incident in the same month showed how easily that kind of information gets out. On August 13, hardware wallet maker Trezor told 13,689 customers that a breach at one of its shipping providers had exposed sensitive order data. The number grew to over 80,000.
Nothing links the two cases, and nothing needs to. Together, they describe the same exposure from both ends: a database that pairs a home address with proof of crypto ownership, and what happens when someone acts on that pairing.
BeInCrypto spoke with experts from Hacken and Zama to uncover what a provider owes its customers when a supplier leaks their identity, which data the industry should stop keeping, and how a client could tell that a custodian will fail them under coercion.
What “No Keys Compromised” Leaves Out
When Trezor announced the breach in August, it made a point of what had not happened. Its own systems were not compromised, it said, and its devices were secure.
Those assurances addressed the risk that hardware wallets exist to prevent: theft of funds.
However, Hacken’s Head of GRC and Security Operations, Dmytro Yasmanovych, explained that the absence of a stolen private key does not mean customers are out of danger.
“Someone who knows your name, home address, and that you own a hardware wallet has information they can use to target you. You can replace a compromised key in minutes. You cannot do the same with your home address.”
He argues that this is why the information held by delivery companies and other suppliers deserves as much attention as the wallet itself. If a database links a crypto holder to their home, the consequences can reach their family, too, Yasmanovych added.
“So a provider can prevent anyone from accessing your funds and still leave you exposed in a much more personal way. The question is whether its security measures protect the customer, not just the wallet.”
The French Numbers Behind the Warning
France shows what that looks like. Interior Minister Laurent Nuñez said in late June that authorities had recorded more than 70 crypto-related violent incidents since January.
Chainalysis, which counted publicly reported cases, logged 30 in France through mid-2026, compared with 19 for the whole of 2025.
The firm calls a data breach the likeliest cause. It points to a 2024 case in which a French tax official allegedly stole dossiers on high-net-worth crypto holders, including addresses and phone numbers, and sold them to criminal intermediaries.
The family exposure Yasmanovych describes is visible in the same data. In France, more than 40% of incidents targeted a relative rather than the holder. Overall, home invasions made up 37% of documented attacks by mid-2026, up from 26% in 2023.
Chainalysis estimated that violent attacks on holders worldwide took more than $30 million in the first half of the year. This counts only attacks where the holder gave up funds.
The report puts total exposure at $107 million, including ransom demands, blocked transfers, and recovered funds, while noting that even that figure covers only reported cases.
The Data Behind the Target
Those attacks need a target, and the target may come from a record somebody kept. That makes data retention another security issue for the crypto industry.
Companies may need customer information for a specific transaction or service. However, keeping it indefinitely can create a separate risk if that information is later exposed. So which piece of customer information should the industry stop collecting, or delete sooner than it does?
Yasmanovych names the phone number. He explained that a company might need one to arrange a delivery, but that does not explain why it should remain in a customer database for years.
Thus, if the database is breached, the number can become useful for phishing, voice scams, or SIM-swap attempts.
“I would remove the link between an order and a physical delivery address once the delivery is complete and there is no longer a business reason to keep it. The company can retain what it needs for tax and warranty purposes without keeping a complete record of where every order was delivered.”
He outlined another problem: deleting data often relies on someone saying it has been done.
“In one case, a company had a ninety-day retention rule and written confirmation from its fulfilment partner that older records had been removed. Years of data was still sitting in their systems. That is why I would want evidence of deletion, not just a retention policy. If nobody checks whether the rule was followed, the rule offers little protection.”
The same responsibility extends to what happens after customer information is exposed. According to Yasmanovych, in addition to a warning email, the provider needs to explain exactly what information was exposed.
“A leaked city is one thing. A name, home address, and proof of crypto ownership create a different level of risk…Someone whose address was leaked may need help arranging future deliveries without sharing it again… There should be a direct person or team to contact when the situation requires more than a standard FAQ.”
He mentioned that the provider also needs to address what allowed the exposure to happen. If the supplier keeps data beyond the agreed retention period, customers should be told how that will be prevented and how deletion will be checked in the future.
“A warning email is the starting point. People need to know what happened, what they can do now, and whether the company has actually fixed the process that failed.”
Trezor’s response to its own breach can be measured against that list. It emailed affected customers individually, specifying whether their exposure was full or partial, and warned about phishing and, in September, physical security risks.
It also promised an Anonymous Delivery option using locker pickup, unbranded packaging, and automatic deletion of shipping identifiers.
Can Privacy Technology Close the Gap?
The problem is not limited to the data companies store off-chain. As more financial activity moves onto public blockchains, the transactions themselves can create another layer of exposure.
Zama CEO and Co-Founder Dr. Rand Hindi said the Trezor incident highlights an off-chain data retention problem.
He argued that as institutional capital moves onchain at scale, onchain confidentiality stops being a feature and becomes the condition for participation. Hindi cited a BCG estimate that digital real-world assets could reach roughly 16% of global investable assets by 2035.
He said regulated institutions cannot operate on a public ledger where every position and counterparty relationship is visible. The executive pointed to fully homomorphic encryption (FHE) as one way to address this without sacrificing compliance.
“FHE allows computation directly on encrypted data – a transfer executes, an AML threshold is checked, eligibility is verified, all on ciphertext – with no validator or block explorer ever seeing a balance or other sensitive data. When a regulator requires access, a permissioned threshold of key holders (compliance team) authorises decryption enforced at the protocol layer, not through a policy.”
Privacy technology can also limit how much information companies must disclose without making verification impossible.
Yasmanovych said zero-knowledge proofs can allow an exchange to demonstrate that it holds enough assets to cover customer balances without publishing every customer’s balance.
The exchange can therefore share evidence of its overall position without putting individual account information on display. The expert added that this does not mean the information becomes inaccessible.
Depending on how the system is designed, an authorised investigator may still be able to examine the evidence and underlying records through an appropriate audit or legal process.
He added that selective disclosure works on a similar principle when sharing identity information. A service might need to confirm that someone meets a particular requirement without receiving their entire identity document or customer profile.
“Neither approach solves the problem of personal data held outside the blockchain. Transaction amounts, timing, and wallet connections may remain visible, while identity documents and home addresses continue to sit in exchange, delivery, and payment databases.”
Yasmanovych mentioned that the gap is fairly straightforward. A company can improve privacy around the transaction itself while leaving the information needed to deliver and support that transaction exposed elsewhere.
When the Credentials Are Real, and the Customer Is Not Free
The distinction between transaction privacy and personal safety becomes even more important when a customer is forced to authorise a transfer. A custody provider may have secure infrastructure and strong access controls.
But those safeguards face a different test when a customer is coerced into handing over their assets.
Yasmanovych said a technical audit can show that the system works as designed. It is less useful for understanding what happens when someone is forced to hand over their assets.
“I would test the withdrawal process under that kind of pressure. For example, a customer with valid credentials requests a large transfer while someone is coercing them. Can the provider recognise the situation, pause the withdrawal, or bring in someone else before the money leaves?”
His required controls are a second authorised person and a mandatory delay on large transfers, neither of which the customer can remove during the same session. Yasmanovych highlighted that the point is to give the provider a chance to intervene when a valid login does not necessarily mean the customer is acting freely.
“I would also ask to see the process in action. A policy can require a second approval, but that does not tell you whether the approval is genuinely independent or whether staff can bypass it. A live test would expose those weaknesses much faster than another clean technical audit.”
A custody system can work exactly as designed and still fail the person using it. The last step always runs through a human being, and a human being can be threatened.
Source: BeInCrypto
