Leaked compliance records shatter anonymity of 291 crypto users by matching names directly to wallet activity

The Pocket Bitcoin breach exposed more than email addresses and support conversations for 291 customers, the company said. Some copied records linked real-world identities to public Bitcoin activity.

The finding expands the scope described in the Swiss non-custodial Bitcoin service's Aug. 21 disclosure. In an Aug. 31 update, Pocket Bitcoin said correspondence with partner banks contained varying combinations of names, postal addresses, Bitcoin addresses used for transactions, identity-document copies and source-of-funds records. Most people in the cohort had only some of those fields exposed, the company said.

The distinction creates a privacy and phishing risk without giving an attacker control of anyone's wallet.

Why public Bitcoin addresses still matter

Bitcoin addresses are public. Anyone with an address can inspect its balance and transaction history on the blockchain, as Bitcoin.org's privacy guidance explains. Connecting an address to a name and, for some customers, a postal address or payment amount removes a layer of separation between a person's offline identity and public on-chain activity.

The exposed information cannot, by itself, move Bitcoin. Spending requires a valid signature made with the corresponding private key, according to the Bitcoin developer guide. Pocket Bitcoin said it is non-custodial, never held customers' private keys and saw no risk to customer funds.