This gives me a thought: is there any service out there that creates and monitors canary tokens on a larger scale to try to identify when specific providers have been breached?

In light of the LastPass breach, it seems like it would be useful if someone had created a few LastPass vaults and seeded them with some canary tokens (and probably canary crypto wallets), so if any of those tokens or wallets were used, it would almost certainly indicate that attackers had breached LastPass and successfully cracked vault passwords.