Your Coins Were Safe. Your Identity Wasn't

Pocket Bitcoin is a regulated Swiss service that sells bitcoin to customers. It is non-custodial — it never holds your coins, never holds your keys, and delivers purchases directly to an address you control. By the standard we argue for on this site constantly, it is built the right way.

In August it was breached. No private keys were taken. No customer bitcoin was at risk. And 5,411 customers were harmed anyway, some of them permanently.

That combination is the whole lesson, and it is one we should state plainly because it complicates our own argument: non-custodial architecture protects your coins. It does nothing whatsoever to protect your identity.

What happened

An attacker had access to Pocket Bitcoin's customer support system for roughly a week in mid-August. The company detected the intrusion while it was in progress, cut off access on 16 August, confirmed on 19 August that an internal database had been copied, disclosed publicly on 21 August, and published a detailed breakdown on 31 August after completing its investigation. It notified authorities in Switzerland and Liechtenstein and filed a police report.

Two groups were affected, and the distinction matters enormously:

• 5,120 customers appeared in transaction lists that partner banks had sent during compliance checks. Exposed: names, residential addresses, transfer amounts, transaction dates, and in some cases the IBAN used.
• 291 customers had it far worse. Their correspondence with partner banks was stored in the affected system, and depending on the case that included names, postal addresses, the Bitcoin addresses used in their transactions, copies of identity documents, and source-of-funds documentation.

A wider group had email addresses and support conversations exposed — including attachments sent through email, Telegram and WhatsApp.

Crucially, Pocket Bitcoin's core customer and transaction databases were not breached. The sensitive material leaked because copies of bank correspondence had been retained inside the support system. The data escaped through the side door, not the front.

Why the 291 is the number that matters

Bitcoin's ledger is public. That is the design. Anyone can see every transaction any address has ever made, and every transaction it makes in future. The only thing standing between that public record and your name is the absence of a link between them.

For those 291 people, that link now exists in a copied database somewhere. Their real name, their home address, their government ID, and the Bitcoin addresses they used — in one file. Anyone holding it can look up those addresses on a block explorer and read the entire history: what they bought, when, how much, and where it went afterwards. Going forward, too.

You cannot undo this. A leaked password gets changed in thirty seconds. A leaked credit card gets reissued. A leaked link between your identity and a public blockchain address is permanent, because the blockchain is permanent. The company did not lose money that can be repaid; it lost information that cannot be un-lost.

And there is a harder edge to it. Names, home addresses and transaction amounts, in one list, is a targeting document. The crypto industry has spent two years watching a rise in physical robberies of known holders. This is exactly the raw material those attacks are built from — which is why the affected group's risk is not merely theoretical embarrassment.

To be fair to Pocket Bitcoin

It would be easy and cheap to make this a story about a careless company. It isn't one, and pretending otherwise would let the real lesson escape.

They detected an intrusion in progress rather than learning about it months later from a researcher. They cut access within days, disclosed within five days of confirming, filed with two regulators and the police, published a specific breakdown rather than a vague statement, and contacted every affected customer individually about their particular exposure. Compare that to disclosure practices we have covered this year and it is close to a model response.

More importantly: they were required by law to collect most of this data. A regulated service must verify identity and, for many transactions, the source of funds. The correspondence with partner banks that leaked exists because compliance requires it to exist. Pocket Bitcoin did not hoard this information out of carelessness — it was the cost of operating legally.

Which is the uncomfortable conclusion. The vulnerability was not a bug in their systems. It was the data itself. Every regulated on-ramp on earth holds a version of this file, and as we wrote in June, data that exists can be breached, subpoenaed, sold in a bankruptcy, or copied by an employee. Good security reduces the probability. It never reaches zero, and the damage when it fails is permanent.

If you were affected — or want to reduce your exposure

• Treat the identity-to-address link as permanent. It cannot be revoked. Plan around it rather than hoping.
• Move funds to addresses that were never in the leak. This does not erase the history of the old addresses, but it stops your future activity from being trivially attributable. Use a fresh wallet, not just a fresh address in the same one, if the exposure was significant.
• Expect targeted phishing. Attackers now have names, addresses, email histories and support conversations. Messages will be convincing and will reference real details. No legitimate service will ever ask for your seed phrase, and any "urgent security migration" contact should be assumed hostile.
• Take the physical-security element seriously if your exposure included amounts. Consider what is publicly linkable to your home address.
• Stop reusing addresses, permanently. A fresh receive address per transaction is the single highest-value habit in Bitcoin privacy — it is what limits how much any future leak can reveal. Most modern wallets do this automatically; check that yours does.

What this means for how you buy

We are not going to tell you to avoid regulated on-ramps. Most people need a fiat entry point, those are the legal route, and following the law where you live is not optional.

But there is a distinction worth understanding. Converting fiat to crypto generally requires identity verification. Converting one crypto asset you already own into another does not have to — and every time you route that through a KYC'd platform, you add another copy of your identity to another company's database, for a transaction that never required it.

That is the gap TokensFund fills. Swaps run wallet to wallet across THORChain, Chainflip, Changee and CCE.Cash, routed to the best rate, with no account and no KYC for standard swaps and a flat 1% inside the quote. We collect no identity documents, so there is no file to lose. It is not a substitute for a fiat on-ramp; it is a reason not to use one more often than you need to.

A note on risk

Nothing here is financial, legal or security advice. Details reflect Pocket Bitcoin's published disclosures of 21 and 31 August 2026 and contemporaneous reporting; the company states no misuse of the exposed data has been detected. Nothing in this article alleges negligence. You remain responsible for complying with the laws and tax obligations that apply where you live — reducing unnecessary data exposure is not the same as avoiding obligations.