Pocket Bitcoin Breach Links Identities to Wallet Data

Pocket Bitcoin has confirmed that a security incident exposed support correspondence containing sensitive information for 291 customers, including combinations of names, postal addresses, Bitcoin addresses, identity documents, source-of-funds records and payment amounts.

The non-custodial service says its customer and transaction databases were not compromised. Private keys never left customer devices, and the exposed information cannot be used by itself to move Bitcoin.

The privacy consequence is different. For some affected customers, a public Bitcoin address can now be connected to a real name, a postal address or an amount. Anyone holding an exposed address can inspect its visible balance and history on the blockchain with a clearer idea of who may control it.

Pocket Bitcoin says all 291 customers received a direct notice describing the information affected in their individual cases. The company reports no current indication that the data has been misused, while warning that incident-specific messages could make phishing attempts more convincing.

A compliance-layer privacy failure

The incident did not break Bitcoin's custody model. It exposed a weakness around the data accumulated when regulated services document identity, payments and source of funds.

That distinction matters. Self-custody can prevent a service provider from moving a user's coins, but it cannot protect identity data copied into support or banking correspondence. When those records include a Bitcoin address, compliance infrastructure can become a bridge between personal identity and an otherwise pseudonymous transaction history.

Pocket Bitcoin says the vulnerability has been closed, additional safeguards were added and the forensic investigation is complete. It reported the incident to the Swiss Federal Data Protection and Information Commissioner and filed a police report.

For an affected address, moving funds does not erase its past public history. It can separate future activity from the exposed address, but any response must consider wallet structure, tax records and the risk of creating additional links.

The next signal is whether the exposed information appears in targeted phishing, extortion or blockchain-surveillance activity. At the time of review, Pocket Bitcoin says it has seen no such misuse.

Sources and disclosures

Affected-customer counts, data categories and incident status are from Pocket Bitcoin's August 31 update. Different customers had different combinations of exposed information; the company did not say that every record contained every category.

Update note

Published and publicly verified September 2, 2026.