Crypto Data Breaches & Vendor Leaks
The keys stay safe. The customer list does not — and that list is the next phishing campaign.
A crypto data breach is not usually a theft of funds. It is a theft of context: who you are, which platform you use, how much you hold, what your last ticket was about. Everything a convincing impersonator needs.
The investigations here trace breaches back to the boring places they actually happen — a third-party analytics vendor, a support tool, a phone call to a help desk — and forward to the phishing waves that follow within days.
Documented cases in detail
Phishing lists rarely come from the wallet itself: the CoinTracker data breach through its Mixpanel analytics vendor exposed emails and wallet fragments — no keys stolen, but a pre-qualified target list.
Ledger never asks for the 24 words, which is the whole point of the fake Ledger letter scam that phishes a seed phrase by post and QR code — printed pages, a boxed device and a recovery phrase the sender already knows.
How it works
The soft edge
The exchange is hardened; the analytics vendor, CRM or outsourced support desk is not. Access there is access to customers.
The enrichment
Leaked records are merged with older dumps to build a profile: balance range, platform, language, timezone.
The follow-up
A support call or email that knows your last ticket. The credibility is borrowed from the breach, not manufactured.
Investigations in this vector
Revolut Data Breach: The Fake Gov Email That Passed DMARC
Revolut released passports, KYC selfies and Bitcoin histories to a fake government request that passed DMARC. What leaked and how to protect yourself.
Read the investigationShinyHunters Hacked Figure: 1M Users Exposed [2026]
One phone call gave hackers full admin access to a $5.3B blockchain lender. 2.5 GB of customer data leaked. Check if your data was compromised.
Read the investigationCoinTracker Data Breach: Was Your Email Leaked?
Mixpanel's vendor hack leaked CoinTracker users' emails and partial wallets. What was exposed, what wasn't, and how to lock your accounts now.
Read the investigationRed flags
- Inbound contact that already knows your account details or recent activity.
- A breach notification arriving from anywhere other than the platform's official domain.
- Pressure to 'secure' your account by moving funds to a new address.
- A password reset you did not request, especially alongside a SIM issue.
- Support asking to verify by reading back a code, a phrase or a key.
If it already happened
- 1.Assume the leaked data is permanent: change what you can, and treat the rest as public.
- 2.Move to app-based or hardware 2FA and remove SMS as a recovery path.
- 3.Set a withdrawal allowlist on every exchange account that supports one.
- 4.Expect targeted phishing for months, and verify support contact by calling the platform yourself.
Related vocabulary
Got a suspicious message, link or token?
Paste it into the free detector. No signup, no cost, answer in seconds.