Pocket Bitcoin Data Breach Exposes Personal and Financial Information of 5,411 Customers

Pocket Bitcoin stated on September 3 that the security breach that occurred in August has compromised more personal and financial information of 5,411 customers than was originally disclosed. The Swiss Bitcoin service provider has found two different categories of customers, according to its forensic analysis. The first was bank transaction information from 5,120 clients. The second was correspondence with potentially more sensitive information from 291 clients. The larger dataset comprised transaction lists that partner banks had sent to Pocket Bitcoin when performing checks. 

Exposed Correspondence Included Bitcoin Addresses and ID Copies

The information provided to Pocket Bitcoin included customers' names, their home addresses, the amount transferred, and the date of the transfer. In some cases, even the IBAN related to the transfer was available. The latter part comprised the correspondence between Pocket Bitcoin and its partner banks. For each particular customer, different information was revealed, such as names, mailing addresses, Bitcoin addresses, and ID copies. 

The firm revealed that the data was in various combinations, implying that not all 291 customers possess all types of data that had been listed. Pocket Bitcoin has reached out to the affected customers individually regarding the details of their cases. The two groups include a total of 5,411 users. There may be other users who were impacted by the company's previous disclosure, but those who did not receive any notification should continue to rely on the original notice given by the company. 

Pocket Bitcoin stated that there was no breach of their primary database of customers and transactions. This data was retrieved from emails and lists generated by the bank in a copy of its backup database. This is why data that appears to be similar to transaction and identification records was revealed, even though the databases were not compromised. The compromised support materials consisted of copies of data created or received as a result of regulatory compliance activities.

According to the company, the accounts containing Bitcoin were never accessible to the hacker. Buying and selling services work just fine. The company also added that, at the moment, it doesn't seem that the information that was made public has been used in any malicious way. The case was reported by Pocket Bitcoin to the Swiss Federal Data Protection and Information Commissioner and the Liechtenstein Data Protection Authority. However, it also filed a police report without giving any information regarding the identity of the possible attacker.

In a similar incident in August, SafePal revealed that due to an authorisation vulnerability in the order tracking plugin, the order data of around 39,798 customers was at risk of being leaked. This data pertained to customers who had made their orders from March 2, 2025, through April 11, 2026, and included names, email addresses, shipping addresses, phone numbers, and purchase details.