Loading story…
Bits of Gold, Israel’s largest regulated cryptocurrency broker, disclosed a data breach after attackers gained unauthorized access through a third-party vendor system tied to a broader software supply-chain incident. The Tel Aviv-based firm said the compromise may have affected about 200,000 customers and exposed personal and financial information including names, national ID numbers, email addresses, contact details, IP addresses, bank account numbers, and public cryptocurrency wallet addresses.
The company said there is no indication it was specifically targeted and reported that passwords, private keys, scanned IDs, full payment card numbers, and card security codes were not exposed. Bits of Gold isolated the affected system, notified regulators, and brought in a specialized incident response firm, while the identity of the compromised vendor and the full scope of affected customers remain under investigation; the company also said it has not yet found evidence of malicious use of the stolen data.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Bits of Gold publicly reported the incident on Sunday, describing it as part of a broader attack on a software provider that may have affected hundreds of businesses worldwide. Separate reporting said the breach affected roughly 200,000 customers, though Bits of Gold had not confirmed that figure.
On Aug. 16, Bits of Gold notified customers that a breach in a third-party vendor system may have exposed personal and financial data, including names, national ID numbers, contact details, IP addresses, bank account numbers, and public wallet addresses. The company said passwords, private keys, scanned IDs, and full payment card data were not affected.
After detecting the intrusion, Bits of Gold said it disconnected the compromised third-party system from its data sources, alerted regulators, and engaged a specialized cyber incident response firm to investigate. The company also said it found no evidence at that stage of malicious use of the exposed data.
Bits of Gold said it discovered unauthorized access in a third-party system used for customer support and data analysis. The company said the breach originated from a software vendor rather than a direct compromise of its own network.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourceteiss.co.uk
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Betterment** disclosed that a **social engineering** attack against a **third-party platform account** used for customer communications enabled unauthorized access to internal systems in early January, leading to the exposure of personal data tied to **1,435,174 accounts**. The intruder used the access to send **fraudulent crypto-themed promotional messages** impersonating Betterment and promising to “triple” cryptocurrency sent to attacker-controlled wallets (including **Bitcoin and Ethereum** addresses). Betterment said it revoked the unauthorized access the same day it was detected, warned customers to ignore the messages, and initiated a forensic investigation with external incident-response support. Breach analysis and indexing by **Have I Been Pwned** indicated the exposed dataset included **email addresses, names, and location data**, with reporting also citing additional PII such as **dates of birth, physical addresses, phone numbers, device information, and employment-related details**. Betterment stated there is **no evidence** that customer investment accounts were accessed or that **passwords/authentication tokens** were compromised, characterizing the incident as an exposure of contact/identity data rather than account credentials. Separate reporting noted Betterment also experienced **intermittent outages attributed to a DDoS attack and extortion attempts** around the same period, but this was described as distinct from the social-engineering-driven data exposure.
Jun 29, 2026
Coinbase confirmed an **insider data breach** in which a single contractor improperly accessed customer information affecting approximately **30 customers**. Coinbase said its security team detected the activity, the contractor no longer provides services to the company, impacted users were notified, and **identity theft protection** was offered; Coinbase also reported the incident to relevant regulators. The disclosure followed brief Telegram posts by threat actors showing screenshots of an internal **Coinbase support interface** that appeared to expose access to sensitive customer data, including **names, email addresses, phone numbers, dates of birth, and KYC information** (and, per the leaked interface screenshots, potentially wallet balances and transaction details). Reporting indicated the incident is **separate from the previously disclosed TaskUs-related insider breach**, and it remains unclear whether the group that posted the screenshots (reported as **“Scattered Lapsus Hunters”**) conducted the access or merely obtained and shared the data; the incident highlights ongoing targeting of **BPO/contractor ecosystems** due to their privileged access to internal tools and customer records.
Jun 29, 2026
Investment research firm **Zacks** was linked to multiple customer data exposures after datasets allegedly stolen from the company were posted on a popular hacking forum. Zacks first disclosed a breach in December 2022, and reporting in early 2023 said about **820,000 customers** were affected. A larger dataset later surfaced in June 2023, reportedly containing records for nearly **9 million customers**, including names, usernames, email addresses, physical addresses, phone numbers, and passwords stored as **unsalted `SHA-256` hashes**. A separate breach allegedly occurred in June 2024 and was later published online, with the leaked data described as a superset of the earlier incident and expanding the exposure to about **12 million unique email addresses**. The newer dataset reportedly also included IP addresses alongside names, usernames, physical addresses, phone numbers, and unsalted `SHA-256` password hashes. Zacks acknowledged unauthorized access to customer passwords after the earlier disclosures, but the company reportedly did not respond to multiple requests for comment on the 2024 incident.
Jun 29, 2026