When data on holdings gets lost. Documented cases.
What companies, authorities and their service providers store about people gets lost again and again: through hackers, bribed staff, careless contractors or officials looking where they should not. Bitcoin works like cash, so nobody should know who holds how much.
Together, about 46 million people affected in 38 documented cases, 20 of them at authorities and 16 through service providers.
Only cases with a primary source, such as the company’s or authority’s own notice, a court, a prosecutor or a parliament; where no court has ruled, we say so. The list is incomplete, and the cases do not show that DAC8 caused them. Someone in two cases counts twice among those affected.
From data leak to front door
A data leak gives criminals what they would otherwise have to work hard to find out: who holds crypto and where they live. Long retention obligations keep such data available for years.
-
A gang with its own database hackers.
Between late 2023 and early 2025, a criminal enterprise stole more than 250 million dollars in crypto-assets. Its members had set roles: database hacking, target identification, fraudulent calls, money laundering and burglary. It went after people believed to hold large amounts of crypto. Its burglar was sentenced to 78 months in prison in 2026.
Source: US Department of Justice
-
Picked out through apparently hacked data.
Armed attackers hold a man in his home and force him to transfer crypto-assets worth around 68,000 euros. The French police place the case in a series in which criminals target wallet holders whose personal data had apparently been hacked.
Source: Gendarmerie
-
Targeted even when merely believed to hold crypto.
Private individuals who hold crypto-assets, or are believed to, are now also being targeted. In the first half of 2026, the Interior Minister counted 77 abductions, sequestrations and extortions or attempts, against 45 in all of 2025.
Sources: Interior Ministry, Journal du Coin
-
A police officer supplies the home address.
A detective obtains a location warrant under false pretences and gives a client the home address of a man believed to hold a lot of crypto. Soon after, three armed men try to force their way into his home and only flee when the victim fires a shot.
Source: US Department of Justice
Worldwide, 801 physical attacks on holders of bitcoin and other crypto-assets are publicly known. There were 170 in 2025 and 146 in 2026 up to 24 October, 64 of them in the EU.
Most victims stay silent, and many cases never become public.
Open the attack archiveAll data leaks, newest first
A data leak does not stop at the provider: support, shipping and newsletter services hold customer data too, and Trezor’s shipping provider even held orders it had confirmed in writing as deleted. Once stolen, such data can be copied and used again for fraud, such as a fake security alert in Trezor’s name sent to around 347,000 recipients.
38 cases
-
- Holdings or tax data
Tax data as a target list.
At the French crypto tax service, customers’ email addresses, gains and losses and year-end balances fell into the wrong hands. According to the French police, criminals use the data to select victims of violent crime, sometimes misjudging what they actually hold.
Sources: Waltio, Gendarmerie
-
- Name and home address
- Holdings or tax data
The tax administration is breached twice.
Using officials’ stolen credentials, attackers extracted 1.2 million records from the national bank-account register in February, with IBAN, name and postal address. In the summer, data on income, postal address and property on 678,000 individuals and businesses followed from the tax system.
Sources: account register, tax system
-
Court data used for extortion.
A court employee sold confidential data from the justice system and used such data herself to extort a man, threatening his family. He paid more than 92,000 euros. She was sentenced to four years in prison.
Source: Rechtbank Overijssel
-
- Name and home address
The population register, through a company’s access.
Unknown parties misused a private company’s lawful search access to the Danish population register. They obtained names, postal addresses and personal ID numbers of around 8.8 million people, living, emigrated and dead. The police are investigating.
Source: Danish ministry
-
347,000 email addresses from Trezor’s newsletter.
Through a login flaw, attackers got into 138 customer accounts at the newsletter service Brevo, exported contacts from 43 and sent phishing from six. 347,149 email addresses were taken from the list of the wallet maker Trezor. A fake security alert to that list led to an app that asked for the wallet backup; around 2,500 people clicked. According to the trade press, BitBox and the crypto tax service CoinTracking were also affected.
Sources: Brevo, Trezor, Cointelegraph
-
- Name and home address
Orders that should have been deleted long ago.
Unauthorised parties got hold of customers’ names, email addresses, phone numbers and shipping addresses at the wallet maker Trezor’s shipping provider. Among them were orders from 2019 to 2021, although ShipMonk had repeatedly confirmed to Trezor in writing that it had deleted them. According to Trezor, 80,689 customers are affected.
Source: Trezor
-
- Wallet
Wallet addresses with name and ID number.
At the Israeli crypto broker, unknown parties got into an internal analytics system. Customers’ names, ID numbers, email addresses, phone numbers, bank details and wallet addresses were affected. According to the company, ID images, passwords and private keys were not.
Sources: Bits of Gold, Calcalist
-
- Name and home address
- ID document
- Holdings or tax data
Defrauded with real customer data.
Bribed support staff copied customer data, down to ID images and balances. Fraudsters then posed as Coinbase and persuaded customers to send them money. Coinbase estimates the costs, including reimbursements, at 180 to 400 million dollars. Phishing in Coinbase’s name then also rose in Austria.
Sources: Coinbase (Form 8-K), Watchlist Internet
-
- Holdings or tax data
£47m taken through tax accounts.
Using identity data phished elsewhere, criminals created or took over tax accounts at HMRC, the British tax authority, and claimed repayments. HMRC wrote to around 100,000 people affected and told Parliament that £47 million had been taken. It says its own systems were not hacked.
Sources: HMRC, Treasury Committee
-
- Name and home address
The charge: home addresses sold from the population register.
An Amsterdam city employee is accused of looking up names and home addresses in the population register in 2024 and 2025 and selling them to criminals through middlemen. The prosecution links at least 95 violent incidents to his lookups, including 36 explosions, shootings at homes and a kidnapping. The defence disputes the link; the verdict is pending.
Sources: Dutch Public Prosecution Service 2025, Dutch Public Prosecution Service 2026
-
Crypto tax tool users’ data at the analytics provider.
Through phishing text messages to staff, attackers got into the analytics service Mixpanel and exported customer data. Among those affected were the crypto tax tools CoinLedger and CoinTracker: email addresses, names, approximate location and, at CoinTracker, details such as a year’s transaction count. According to the companies, wallet addresses and tax forms were not included.
Sources: Mixpanel, CoinLedger, Protos
-
- Name and home address
- ID document
- Wallet
ID, home address and wallet in one record.
Using an administrator’s reused password, an attacker took the data of around 6,300 users from the Berlin identity verification service: names, ID images, home addresses and wallet addresses. The attackers then demanded a ransom.
Source: Fractal ID
-
- Holdings or tax data
Thousands of searches in bank and tax data.
According to the Perugia prosecutor, an officer of the financial police, the Guardia di Finanza, viewed more than 4,000 money-laundering suspicion reports from banks between 2019 and 2022 and searched more than 1,100 people in the tax database. The case began when details of the defence minister’s finances appeared in the press. In 2026 Rome prosecutors asked for a trial; no one has been convicted so far.
Sources: Chamber of Deputies, 2024 hearing, Sky TG24
-
- Holdings or tax data
Tax data for his own advisory firm.
An official at the Bizkaia tax authority also co-owned a tax advisory firm. From at least 2017 to 2019 he viewed confidential tax data on his firm’s clients and on people and companies around them without authorisation, and used it for the firm. In 2024 the Bizkaia provincial court sentenced him at first instance to ten years in prison.
Source: Spanish judiciary
-
A tax bailiff sells vehicle owner data.
Between 2020 and 2022, a bailiff at the Dutch tax authority looked up licence plates with the owners’ personal data outside working hours and sold them to criminals. Shortly after two of his lookups, a vehicle owner was shot dead near his home; the prosecution could not establish a direct link. In 2024 he was sentenced to three years in prison.
Sources: District Court of The Hague, Dutch Public Prosecution Service
-
Support contacts as a phishing list.
Attackers got into the hardware wallet maker’s third-party support portal. It held the name or nickname and email address of up to 66,000 people who had contacted support since December 2021. The attackers wrote to 41 of them directly, asking for their recovery phrase.
Source: Trezor
-
Bank details at the payment processor.
At a service provider of the bank that handles transfers for the crypto exchange Gemini, names and bank account numbers of Gemini customers were exposed in early June 2024. Gemini reported the incident to the California Attorney General.
Source: Gemini (California filing)
-
- Name and home address
- Holdings or tax data
The balances of crypto creditors.
Through an employee’s hijacked phone number, attackers at the FTX bankruptcy’s claims agent accessed the names, postal addresses and balances of creditors of three crypto companies. Kroll warned of fraudsters asking people to connect a wallet or enter their recovery phrase.
Source: Kroll
-
- Name and home address
Government data at the IT contractor.
A ransomware group stole data from a software supplier to several Swiss federal offices and published around 1.3 million files. Around 65,000 of them concerned the federal government, and 4,779 contained personal data, including postal addresses. Justice and police authorities were hit hardest.
Sources: Swiss National Cyber Security Centre, Swiss Federal Council
-
A blacklist of 270,000 names.
For more than six years, the Dutch tax authority unlawfully kept a list of around 270,000 people it suspected of fraud, often on wrong grounds. Those on it were, for example, refused payment plans. In 2022 the data protection authority fined it 3.7 million euros, in part for failing to secure the list.
Source: Dutch Data Protection Authority
-
Email addresses through its email provider.
Through a Twilio employee’s credentials, the email addresses of users of the crypto tax tool fell into the wrong hands from its email service, SendGrid. According to CoinTracker, no financial data was exposed. The company warned its users of targeted attacks.
Source: CoinTracker
-
Crypto firms’ lists, targeted.
Over several weeks, attackers took over staff access at the newsletter service Mailchimp and targeted the lists of more than 200 crypto and finance firms. At the wallet maker Trezor, email addresses from the newsletter list were taken, some with names. Phishing emails in Trezor’s name followed.
Sources: Trezor, The Record
-
A targeted attack on the crypto industry.
Through a deceived employee, an attacker exported contact data from fewer than 30 customer accounts at the customer database provider HubSpot. HubSpot confirmed a targeted attack on customers in the crypto industry. According to the trade press, BlockFi, Swan Bitcoin and NYDIG were among those affected and warned their customers of phishing.
-
An employee hands over email addresses.
A senior engineer at the email service Customer.io handed the email addresses of users of the NFT marketplace OpenSea and of five other customers to an attacker. According to the trade press, the crypto lender Celsius was one of them. Customer.io fired the employee and reported him to law enforcement.
Sources: Customer.io, The Block
-
Customer data at a vendor, then phishing.
At a vendor of the crypto exchange Gemini, attackers collected customers’ email addresses and partial phone numbers. Phishing campaigns against those customers followed. According to Gemini, its own systems and accounts were not affected.
Source: Gemini
-
- Holdings or tax data
Tax data on neighbours and club mates.
In a random check of the logs, the data protection officer of the Bavarian tax administration found 54 clearly unauthorised queries by a mail-room employee, on colleagues, neighbours and members of his football club. In 2021 the Nuremberg labour court of appeal upheld his dismissal.
Source: LAG Nürnberg, 3 Sa 265/20
-
- Name and home address
- Holdings or tax data
Accounts taken over, funds drained.
Using email addresses, passwords and phone numbers that Coinbase says came from phishing, and a flaw in its SMS account recovery, attackers took over the accounts of at least 6,000 customers. There they saw name, home address, balances and transactions, and drained funds. Coinbase reimbursed the losses.
Source: Coinbase (California filing)
-
- Name and home address
The home addresses of 272,000 wallet buyers.
Names, postal addresses and phone numbers leaked from the hardware wallet maker’s online shop. Phishing emails and text messages followed, asking for the recovery phrase. In a University of Innsbruck survey, 93 of 104 affected customers reported scam attempts and 33 reported extortion threats.
Sources: Ledger, Abramova and Böhme
-
- Holdings or tax data
The tax returns of the wealthiest.
An IT contractor at the US tax authority, the IRS, hid his queries behind broad searches and copied the tax data of thousands of the country’s wealthiest people. He passed it to news organisations. According to a later audit, around 406,000 taxpayers were affected. In 2024 he was sentenced to five years in prison.
Sources: US Department of Justice, TIGTA audit
-
- Name and home address
- Holdings or tax data
Tax accounts taken over, refunds redirected.
Using passwords stolen elsewhere, criminals logged into around 26,000 online accounts at the Canada Revenue Agency and saw data on about 34,000 people, including postal address, tax and banking details. They changed bank details and addresses and collected refunds and benefits. By 2025 the agency counted 42,755 confirmed cases of third parties using taxpayer data without authorisation; in 2026 the privacy commissioner found breaches of the Privacy Act.
Sources: Privacy Commissioner of Canada 2024, Privacy Commissioner of Canada 2026
-
- Name and home address
A public register with home addresses.
The Supplementary Register for Other Affected Parties showed names, dates of birth and postal addresses online; for many self-employed people that was their home address. Many of the entries came from the tax administration, and publication was required by law. When the Covid hardship fund asked for the register number in 2020, this became widely known. The register has not been public since.
Sources: Parliament, answer 2007/AB, ORF
-
- Name and home address
Registration data on millions in Austria, through a test server.
GIS collected Austria’s broadcasting fee and received registration data from the population registers to do so. For a test, it handed at least five million real records to an IT contractor, who loaded them onto an unsecured server. In May 2020 a hacker copied names, postal addresses and dates of birth, which were then offered for sale online. Undercover investigators bought the data the same month. A suspect was arrested in the Netherlands, and the prosecution was handed over there.
Sources: Federal Administrative Court, ORF
-
- Name and home address
- Holdings or tax data
Into customer data through an employee’s phone.
Through an employee’s hijacked phone number, an attacker got into the crypto lender’s back office and saw customers’ names, postal addresses, dates of birth and account activity. His attempts to withdraw funds failed.
Source: BlockFi
-
- Holdings or tax data
The tax authority loses data from the account exchange.
Attackers broke into the Bulgarian tax authority’s systems, and tax and social security data on more than six million people then appeared online. It included account data that Bulgaria had received from other states through the automatic exchange of information, including on accounts in Switzerland and Germany. Afterwards, other states’ obligations to send data to Bulgaria were suspended. DAC8 reports on crypto-assets will travel through the same exchange.
Sources: OECD Global Forum, Swiss SIF, Bundestag, Drs. 19/22077, CJEU C-340/21
-
A tax employee steals identities.
An employee of the US tax authority took names, dates of birth and Social Security numbers from its systems without authorisation. Her group used them to file false tax returns, with hundreds of victims and more than 400,000 dollars in refunds paid out. In 2016 she was sentenced to nine years and two months in prison.
Source: US Department of Justice
-
- Holdings or tax data
Tax transcripts for fraudsters.
Using personal data stolen elsewhere, fraudsters passed the US tax authority’s online identity check and downloaded tax transcripts. According to the audit, they succeeded for another 355,262 taxpayers beyond the roughly 220,000 the authority had reported itself. On tax returns later filed with this data, the authority stopped refunds of 119 million dollars.
Source: TIGTA audit
-
- Name and home address
Two CDs with 25 million records go missing.
HMRC, the British tax authority, sent the entire child benefit database on two CDs by courier to the National Audit Office. They never arrived: names, postal addresses, dates of birth and National Insurance numbers of 25 million people, some with bank details. A review called the loss “entirely avoidable”. The chairman of HMRC resigned.
-
- Holdings or tax data
Thousands of private queries in the tax system.
For six years, a tax official accessed tax records several thousand times without any official reason, including those of more than 1,000 people from his home town. In 2024, Austria’s anti-corruption office registered 116 new cases of unauthorised data queries and disclosures in the public sector.
Sources: Finance Ministry disciplinary board, BAK annual report 2024