Swiss Bitcoin Service Pocket Bitcoin Discloses Breach of 5,411 Customer Records
A security incident involving backup data and support systems exposed personal and financial details of thousands of users.
Pocket Bitcoin, a Swiss-based regulated non-custodial Bitcoin purchasing service, has disclosed a security breach that exposed the personal and financial data of 5,411 customers. The incident, which occurred in August, underscores the persistent risks associated with centralized identity data in the cryptocurrency sector.
According to company disclosures, the breach involved two distinct datasets. The first contained bank transaction records for 5,120 users, while a second, smaller dataset contained communication records for 291 users. The exposed information included names, addresses, bank transfer dates and amounts, and some IBANs. For a subset of users, the leak also included identity documents and public Bitcoin addresses.
The Nature of the Exposure
Pocket Bitcoin clarified that its primary production database, customer Bitcoin holdings, and private keys remained secure throughout the incident. The leaked data was not retrieved from the main environment but was instead sourced from emails and lists generated from a copy of a backup database and a support system. Because the company operates as a non-custodial service, it facilitates the purchase of Bitcoin without holding the private keys for its users, which prevented the direct theft of digital assets.
The KYC Vulnerability
This breach highlights a critical tension in the crypto industry: the conflict between regulatory compliance and user privacy. To operate as a regulated entity in Switzerland, Pocket Bitcoin must implement Know Your Customer (KYC) protocols, which require the collection of government-issued identity documents and bank details.
While these measures satisfy legal requirements, they create a centralized point of failure. When this data is leaked, it can permanently link a user's real-world identity to their public blockchain addresses. Because the blockchain is a permanent, public ledger, once a name is tied to a wallet address, all past and future transactions associated with that address become traceable to a specific individual, effectively removing the pseudonymity that many Bitcoin users rely on for financial privacy.
Industry Implications
As more cryptocurrency services move toward regulated frameworks, the volume of sensitive KYC data stored by intermediaries continues to grow. This incident serves as a reminder that even services that do not hold user funds—non-custodial providers—can still pose a significant privacy risk if their administrative and backup systems are compromised.
Industry observers will be watching how Pocket Bitcoin manages the aftermath of the breach and whether the incident prompts a shift in how regulated Swiss crypto firms handle the storage and encryption of compliance-related data. For now, the company has focused on the fact that the core transaction database remained untouched, though the exposure of identity documents remains a permanent risk for the affected users.