A data breach at a supporting analytics system has exposed the gap between custody security and customer-data security at crypto companies. Israeli broker Bits of Gold said unauthorized access may have revealed identity, banking, contact, and public wallet information even though customer funds and private keys were not involved.
In an August 16 security notice , the company said it detected access to a data-analysis system during a broader cyber incident that affected other companies. Bits of Gold blocked the access, disconnected the system from its information sources, notified relevant authorities, and hired a specialist incident-response firm.
What Information May Have Been Exposed
The company’s initial review found that the attacker may have accessed names, national identification numbers, email addresses, phone numbers, IP addresses, bank-account details, and public cryptocurrency wallet addresses.
Bits of Gold said it had no indication at the time of the notice that the information had been misused. The investigation remains open, which means the confirmed scope could change as forensic work continues.
The company stated that customer assets and funds were safe. It also said passwords, scanned identity documents, full credit-card numbers, CVV codes, and private keys were not exposed. Services continued operating normally.
The Immediate Risk Is Social Engineering
The exposed fields can still be valuable to criminals. A combination of an identity number, bank details, phone number, and known wallet address can make a phishing message appear credible or help an attacker target a specific customer.
Bits of Gold warned users not to click suspicious links, disclose verification codes, or transfer money or digital assets in response to unsolicited contact. It emphasized that the company will not ask customers for passwords, private keys, verification codes, or transfers to another wallet.
Third-Party Systems Remain a Crypto Weak Point
The incident is distinct from theft caused by compromised signing keys or a smart-contract flaw. It shows that a regulated broker can protect its custody environment while personal data leaks through software used for analytics, support, fulfillment, or marketing.
That distinction matters because public wallet addresses can connect off-chain identity data to visible blockchain activity. Even without a private key, an attacker may use that information to identify high-value targets or design more convincing impersonation attempts.
The risk is especially relevant after the Coldcard exploit and its wider Bitcoin security debate . Hardware and protocol defenses address only part of the threat model; vendors and data processors can create separate exposure paths.
Bits of Gold said it will provide further updates if material information emerges. Until then, the defensible conclusion is limited: customer funds were not reported stolen, but sensitive personal information may have been exposed, and users face an elevated phishing risk while the investigation continues.
