There have been some cases where fitness tracker data shows where some military installations are located. Or when they're jogging on a ship that's taking them to deployment somewhere.

The Ukraine war has shown that cheap intelligence tricks can be used against the average recruit, like pretending to be a dating website and getting the GPS locations of horny enemy soldiers so your drones can drop grenades on them.

It doesn't need to be crypto wallet tracking. The amount of spyware being built into phone apps is where those agencies would be putting some effort into obtaining access to.