Pocket Bitcoin breach reveals personal and financial data of 5,411 customers

Pocket Bitcoin announced on September 3 that its August security incident exposed personal and financial information for a total of 5,411 customers, expanding on its earlier disclosure.

Two distinct data sets were compromised

The forensic investigation identified:

• Bank transaction lists involving 5,120 customers. These lists, supplied by partner banks for compliance checks, contained names, residential addresses, transfer amounts, dates and, in some cases, IBAN numbers.
• Correspondence records for 291 customers. These communications with partner banks could include names, postal addresses, public Bitcoin addresses, copies of identity documents and source‑of‑funds information. Not every record contained all data types.

Core systems and Bitcoin holdings remained secure

Pocket Bitcoin confirmed that its main customer databases, transaction systems, private keys and customers’ Bitcoin balances were not accessed. The exposed data originated from copies of compliance‑related documents stored in a backup of the support system.

Regulatory notification and response

The company reported the breach to Switzerland’s Federal Data Protection and Information Commissioner and Liechtenstein’s Data Protection Office, and filed a police report. It has contacted the affected customers individually and is implementing additional safeguards for handling bank correspondence and compliance records.

Potential risks and recommended actions

While no misuse of the data has been detected, the inclusion of names and addresses creates a risk of physical phishing or impersonation attempts. Pocket Bitcoin advises users to monitor bank activity and treat unexpected letters, calls, or messages with caution. The company reiterates that it will never request seed phrases or Bitcoin transfers via unsolicited phone calls or letters.