France logs 70+ crypto kidnappings in eight months as 80,689 Trezor buyers' home addresses leak

At about four in the morning on Sunday 20 September 2026, four masked men broke into a house in Vendin-le-Vieil, in northern France. They tied up a man who works in IT for a crypto company, his wife and their two children, and held them for about three hours, until roughly €40,000 in crypto had been transferred. Prosecutors opened an investigation for unlawful confinement and extortion by an organised gang. No arrests have been reported.

The case is one of many. According to figures reported by Decrypt and Crypto Briefing, French authorities recorded more than 70 crypto-related kidnappings and confinements in the first eight months of 2026.

How do they know where you live?

In this case nobody has said. The general answer is less mysterious, and September supplied an example.

On 4 September Trezor updated a breach notice it had first published in August. Two days earlier its shipping partner, ShipMonk, had told it the breach was larger than stated: it also covered orders placed between November 2019 and August 2021. About 67,000 more US customers were affected, which brings the total to 80,689. For most of them the exposed data is a full name, a shipping address, a phone number and an e-mail address.

By Trezor's own policy that data should no longer have existed. "We repeatedly requested and received written assurance confirming the deletion of the data," the company wrote. "We are very disappointed that, despite receiving this confirmation, the data was not deleted in their systems."

Devices, keys and backups were not affected. What leaked is something else: a list of people who own a hardware wallet, with the address it was delivered to.

A few days later, customers of Trezor and other wallet makers received a fake "critical security alert" asking for their recovery phrase. It was sent after a breach at an e-mail marketing provider.

What follows from it

Nothing here says the French attackers used a leaked list. The point is narrower. Lists like this exist, they outlive the promises made about them, and they contain exactly what a home invader needs. An earlier note covers how identity files leak from the companies that collect them.

What you can do

• Do not have crypto hardware delivered to your home under your own name if there is an alternative: a pickup point, a parcel locker, a work address.
• Use a separate e-mail address for crypto purchases, one that is not tied to your other accounts.
• Never type a recovery phrase into a website or an e-mail reply. No wallet maker asks for it.
• Say less. The French victim was reported to be an employee in the sector, not a public figure. Being identifiable as someone who works with crypto was enough.

Sources: Trezor — customer data exposed in shipping provider incident, Crypto Briefing, 21 Sept 2026 — France, Malwarebytes, 11 Sept 2026 — phishing after e-mail provider breach