Crypto Fraud Watch: 13,689 Trezor Owners Exposed, MSCI Moves to Cut Strategy, and Bitcoin Slips Under $63,000

The week closed with a breach that never touched a private key, an index proposal aimed at the largest corporate bitcoin holder, and a Friday slide that pushed XRP under a dollar. Here is what broke in the last 48 hours and what it means legally.

A Shipping Vendor Breach Hands Scammers a List of Wallet Owners

Trezor disclosed on August 13 that ShipMonk, the logistics provider fulfilling its hardware wallet orders, was breached, exposing 13,689 customers. Of those, 11,742 had name, email, phone and shipping address fully exposed, on orders shipped between May 10 and August 8. The root cause sits further upstream: attackers exploited CVE-2026-72898, an unauthenticated SQL injection flaw in the analytics platform Metabase rated CVSS 10.0, starting around August 3.

No wallets, seed phrases or funds were touched. That is cold comfort. What leaked is a verified list of people known to hold self-custodied crypto, matched to home addresses, which is exactly the input needed for targeted phishing and physical extortion. Breach notification duties generally attach to the entity controlling the data, not the vendor that lost it, and the EU and UK customers here pull GDPR timelines in as well.

MSCI Proposes a Rule That Would Delete Strategy From Its Indexes

MSCI opened a public consultation on August 14 that would make "non-operating companies" ineligible for its Global Investable Market Indexes. A Core Screen asks whether operating assets exceed 50% of total assets; an Exclusion Screen then flags companies failing at least four of five financial ratios. Applied to May 2026 data, it removes Strategy, Metaplanet and uranium holder Yellow Cake from the MSCI ACWI IMI. Feedback closes September 30, results land October 16, and any change takes effect at the November review.

MSCI is a private index provider, not a regulator, so there is no comment right, no administrative appeal and no APA challenge here. On the issuer side, a company facing a scheduled, foreseeable wave of forced passive selling has a disclosure problem to manage, and October 16 is a date affected issuers' counsel should have circled.

Bitcoin Slips Under $63,000 as XRP Breaks a Dollar

Bitcoin fell 0.67% Friday to roughly $62,976, down nearly 4% on the week. Ether slipped to about $1,881, Solana to $75.33, and XRP closed at $0.998, its first sub-dollar print in two years. Spot bitcoin ETFs shed roughly $333 million across the week. Drawdowns matter legally because they surface fraud that rising prices conceal: redemption freezes, sudden changes to withdrawal terms and a spike in unsolicited "fund recovery" offers all track the market lower.

Israel's Largest Bank Puts Bitcoin Inside Its Banking App

Bank Leumi announced on August 14 that it will offer bitcoin, ether and solana trading in early 2027, the first Israeli bank to do so. Trading runs through GalaxyOne Institutional, with custody handled by Galaxy's custody arm, formerly GK8, inside the existing Leumi Trade app. Fees and a launch date remain undisclosed. Bank-intermediated crypto changes the legal posture: a customer whose coins go missing from a regulated bank has a supervised counterparty and a complaints process, neither of which exists in self-custody. The tradeoff is that account terms, not the blockchain, define who bears an unauthorized transfer.

How to Protect Yourself

If you ordered a hardware wallet in recent months, assume your details are circulating and treat every unexpected email, call, text or letter about that order as hostile until proven otherwise. No legitimate vendor will ever ask for your seed phrase. Verify through the manufacturer's official site rather than clicking a link, and extend that suspicion to physical mail and unexpected couriers.

Most US states and the GDPR give affected individuals notification rights and sometimes private causes of action, though claims turn heavily on notification timing and the specific facts. If money is already gone, preserve transaction hashes, wallet addresses and message logs, report to IC3, and get counsel involved early.

At Coin Counsel, we work with individuals and businesses navigating the legal fallout of crypto fraud — whether you're a victim seeking recovery, a company facing regulatory scrutiny, or a project working to stay compliant in an increasingly complex legal landscape. The rules are evolving fast, and the cost of getting it wrong has never been higher. Contact us at coin-counsel.com to speak with a crypto-focused attorney today.

Disclaimer

This blog post is for informational purposes only and does not constitute legal advice. Reading this content does not create an attorney-client relationship between you and Coin Counsel or Franco Law PLLC. The legal landscape surrounding cryptocurrency is rapidly evolving and varies by jurisdiction. Do not act or refrain from acting based on information in this post without first consulting a qualified attorney. If you believe you have been the victim of crypto fraud, contact us at coin-counsel.com for a consultation.