Three breaches landed in four days, each rooted in a vendor the end user never chose and likely never knew existed. SafePal lost 39,798 customer records to a plugin flaw. Trezor lost 13,689 through its shipping provider ShipMonk. Bits of Gold, Israel’s largest regulated crypto broker, lost roughly 200,000 through an analytics tool. No wallets were drained. No keys were stolen. What was stolen is worse for a specific and growing class of crime: verified proof that a person at a known address owns cryptocurrency, paired with their phone number and in some cases their government identification number.