.jpg)
The Pocket Bitcoin breach has turned out to be bigger than first disclosed, with the Swiss broker confirming on Sept. 3 that its completed forensic investigation found 5,411 customer records exposed across two data groups — including bank transfer details and, for some customers, identity documents and source-of-funds records.
The company's initial disclosure about its August security incident covered email addresses and support conversations. The finished investigation added two groups: one containing bank transaction lists that partner banks sent to Pocket Bitcoin during compliance checks — names, residential addresses, transfer amounts, transaction dates and sometimes the IBAN connected to a transfer, involving 5,120 customers — and a second covering correspondence Pocket sent to partner banks, which for 291 customers could include public Bitcoin addresses, identity document copies and sensitive source-of-funds records in varying combinations. Pocket Bitcoin announced the update on X (Twitter), stating that in some cases more data was affected than originally described.
What the Pocket Bitcoin breach didn't touch
The scope boundaries are as important as the exposure. Pocket said attackers did not compromise its main customer or transaction databases — the exposed records came from correspondence and bank-generated lists stored in a copied backup within the affected support system, data produced or received during regulatory compliance procedures. The firm operates as a noncustodial service that never holds customers' private keys, so customer Bitcoin balances were never accessible to the attacker, and buying and selling services continue operating normally. A disclosed public Bitcoin address cannot authorize a transfer, though linking an address to a customer's identity lets another person inspect its visible blockchain activity — history that moving funds cannot erase.
The company has contacted affected customers individually with case-specific details and says it currently has no indication that any exposed information has been misused — a statement reflecting information available after the investigation, not a guarantee against future misuse. It notified Switzerland's Federal Data Protection and Information Commissioner and Liechtenstein's Data Protection Office, and filed a police report.
Physical phishing is the real risk
The most distinctive warning in Pocket's disclosure concerns mail, not email. Because names and postal addresses were among the exposed data, the company flagged forged letters and other physical communications as particular risks — a fraudster who knows a genuine bank transfer or Bitcoin transaction can make an impersonation attempt appear credible in ways generic scam mail never achieves. Email addresses and login credentials were not linked to the two newly identified groups, so the company sees no direct targeted email-phishing risk arising specifically from those records.
The incident fits a pattern of crypto companies leaking data through adjacent systems while core asset infrastructure stays secure. Three recent breaches exposed 253,487 records, and an August incident at Bits of Gold potentially exposed customer identity, banking and wallet information through a third-party system while funds and passwords remained unaffected — the same architecture-as-the-weak-point story. Malware targeting crypto users keeps growing more sophisticated, impersonation waves are hitting platform users, and every leaked identity-and-address pairing makes those attacks easier to aim. The uncomfortable takeaway for customers of any crypto service: your keys can be safe while your identity is not, and identity leaks age worse than outages — a name, an address and a transaction history can support targeted fraud years after the incident that exposed them.
