Leaked compliance records shatter anonymity of 291 crypto users by matching names directly to wallet activity

Pocket Bitcoin disclosed that a breach of its support system exposed personal and compliance information for 291 customers. The leaked records linked real‑world identities—including names and postal addresses—to public Bitcoin addresses used in transactions.

Scope of the exposure

The compromised data included combinations of:

• Customer names
• Postal addresses
• Bitcoin addresses used for transactions
• Copies of identity documents
• Source‑of‑funds records and payment amounts

Not every record contained all fields; most exposed only a subset.

Impact on wallet security

The breach did not involve private keys. Pocket Bitcoin, a non‑custodial service, never held customers’ private keys, and the company confirmed that no funds were at risk. However, the linkage of personal data to on‑chain activity removes a layer of privacy and could facilitate phishing or social‑engineering attacks.

Company response

Pocket Bitcoin notified each affected customer individually, closed the vulnerability, completed a forensic review, and reported the incident to the Swiss Federal Data Protection and Information Commissioner and law enforcement. The firm stated it has no evidence that the leaked information has been misused.

Broader privacy concerns

Public Bitcoin addresses are inherently visible on the blockchain. When an address is tied to a name or address, it becomes easier for attackers to craft credible communications or apply pressure using location data, as highlighted by Switzerland’s National Cyber Security Centre.