Crypto Data Breaches & Vendor Leaks

A crypto data breach is not usually a theft of funds. It is a theft of context: who you are, which platform you use, how much you hold, what your last ticket was about. Everything a convincing impersonator needs.

How this vector actually works

The investigations here trace breaches back to the boring places they actually happen — a third-party analytics vendor, a support tool, a phone call to a help desk — and forward to the phishing waves that follow within days.

  • The soft edge — The exchange is hardened; the analytics vendor, CRM or outsourced support desk is not. Access there is access to customers.
  • The enrichment — Leaked records are merged with older dumps to build a profile: balance range, platform, language, timezone.
  • The follow-up — A support call or email that knows your last ticket. The credibility is borrowed from the breach, not manufactured.

Red flags you can check in a minute

Any single item below is enough to stop and verify before you sign, send or install anything. The keys stay safe. The customer list does not — and that list is the next phishing campaign.

  • Inbound contact that already knows your account details or recent activity.
  • A breach notification arriving from anywhere other than the platform's official domain.
  • Pressure to 'secure' your account by moving funds to a new address.
  • A password reset you did not request, especially alongside a SIM issue.
  • Support asking to verify by reading back a code, a phrase or a key.

If it already happened

Order matters more than speed of panic: contain the wallet first, preserve the evidence second, report third. Recovery services that contact you after the fact are the follow-up scam.

  • Assume the leaked data is permanent: change what you can, and treat the rest as public.
  • Move to app-based or hardware 2FA and remove SMS as a recovery path.
  • Set a withdrawal allowlist on every exchange account that supports one.
  • Expect targeted phishing for months, and verify support contact by calling the platform yourself.

Related vectors and tools

Most real cases mix two vectors, so read the neighbouring hubs, and run anything suspicious through the detector before you act on it.