Disclosed regulatory documents expose identities of 291 cryptocurrency users through direct connections between personal information and transaction records

A data breach at Swiss Bitcoin service Pocket Bitcoin has directly linked real-world identities to public wallet addresses for 291 customers, creating phishing and fraud risks despite leaving funds secure. The incident highlights how combining public blockchain data with personal information exposes customers to impersonation attacks and physical security threats.

• 291 Pocket Bitcoin customers had names matched to Bitcoin addresses in breached support records from partner banks.
• Exposed data included names, postal addresses, Bitcoin addresses, identity documents, and source-of-funds records in varying combinations.
• Private keys were never compromised, leaving customer funds secure but creating phishing and impersonation risks.

• 291 Customers affected by data linkage of identity to wallet activity
• Aug. 21 Date of Pocket Bitcoin’s initial disclosure of the breach
• Aug. 31 Date of company’s expanded disclosure clarifying scope of exposed data
• $100M Loss from recent hardware wallet attacks escalating beyond data leaks alone

Breach disclosure and initial confusion

Pocket Bitcoin, a non-custodial Swiss Bitcoin service, disclosed on August 21 that a data breach had exposed customer information. The company initially stated that Bitcoin addresses, its customer database and transaction history were not affected. In an August 31 update, however, Pocket Bitcoin clarified that while its core databases remained secure, related information had been included in some correspondence stored in the compromised support system maintained with partner banks.

The delayed clarification underscores challenges that cryptocurrency companies face in communicating breach scope to customers and regulators. Non-custodial Bitcoin services like Pocket Bitcoin typically do not hold customer funds directly, which simplifies certain security responsibilities but creates complex data management scenarios when operational records are compromised. The staggered disclosure timeline likely reflected the company’s need to coordinate with its banking partners to determine exactly what information had been exposed across multiple systems.

Names and addresses linked to public wallet activity

The breach exposed correspondence containing varying combinations of customer names, postal addresses, Bitcoin addresses used for transactions, identity-document copies and source-of-funds records. Most affected customers had only some of those fields exposed rather than the complete set, according to Pocket Bitcoin. The connection between a customer’s real-world identity and postal address to a public Bitcoin address removes anonymity that would otherwise separate a person’s offline identity from their on-chain activity.

Bitcoin addresses themselves are publicly visible on the blockchain, allowing anyone to inspect balances and transaction histories.

The exposure creates a privacy vulnerability and heightens phishing risks. Switzerland’s National Cyber Security Centre has documented scams that use a recipient’s real home address to increase pressure on targets, illustrating how location data combined with identity information can be weaponized. Pocket Bitcoin warned that details from exposed correspondence could make deceptive emails, calls or messages about the incident appear more credible to recipients.

This type of identity-to-address linkage represents a broader privacy concern in the cryptocurrency ecosystem. Users often assume that Bitcoin addresses provide pseudonymity, but exchanges, payment processors and service providers routinely collect identity information for regulatory compliance. When those records are compromised, the pseudonymity evaporates, leaving users exposed to targeting based on their cryptocurrency holdings and transaction patterns.

Customer funds protected despite Identity exposure

The breached information cannot move Bitcoin because spending requires a valid cryptographic signature made with the corresponding private key.

Pocket Bitcoin emphasized that it operates as a non-custodial service and never held customers’ private keys. The company determined there was no risk to customer funds and stated it had no indication that the exposed information had been misused. The distinction matters: while the breach does not give an attacker control over anyone’s wallet, it does create fraud and impersonation risks.

The non-custodial model provides a meaningful security advantage in breach scenarios. Services that custody customer assets on behalf of users face substantially higher stakes when data is compromised. By contrast, Pocket Bitcoin’s architecture means the primary risk from the breach stems from secondary attacks leveraging the exposed identity and contact information rather than direct theft of funds.

Investigation complete and authorities notified

Pocket Bitcoin said its forensic investigation and review of relevant partner-bank correspondence were complete, and the vulnerability had been closed. Each of the 291 affected customers received an individual notice listing the specific data exposed in their case. The company reported the incident to the Swiss Federal Data Protection and Information Commissioner and filed a police report.

The investigation findings and regulatory notification represent standard protocol for data breaches under Switzerland’s data protection framework. However, Pocket Bitcoin acknowledged that its current visibility into the incident does not guarantee that copied information has not been misused, leaving the question of whether affected customers will face follow-on fraud attempts unanswered. Customers should monitor for impersonation attempts and unsolicited contact referencing the breach details, particularly communications claiming to address the incident.

The incident serves as a reminder that securing customer funds is necessary but insufficient for protecting users in the cryptocurrency space. As the industry matures and regulatory requirements drive more identity collection, the intersection of personal data and blockchain activity creates new attack surfaces that require careful protection and transparent disclosure practices.

BlockWest is a news publication. Nothing here is investment advice. Read our disclaimer and editorial policy.