Trezor shipping provider breach exposed names, emails and addresses of 11.7K customers, linking identities to crypto holdings without touching private keys.