- Based co-founder Edison said the company has notified Singaporean authorities after an October 5 breach exposed cardholders’ KYC data.
- Leaked identity records tied to wallet addresses can fuel both extortion and physical attacks.
- Based says its trading app, self-custody wallets and funds were not affected.
Based co-founder Edison said the company has alerted Singapore’s data regulator and filed a police report following a recent breach.
The incident happened on October 5, and the company reported that the internal dashboard behind its Visa card program may have exposed cardholders’ names, passport numbers, birth dates and home addresses.
What update does Based have for its affected users?
In a post on X on October 11, Based’s cofounder Edison said the company’s compliance and operations staff have been contacting people whose data was caught up in the incident. The company has involved the Personal Data Protection Commission (PDPC), Singapore’s privacy watchdog, along with other regulators.
Edison said the team is coordinating with law enforcement on the case.
Cryptopolitan reported that an intruder reached the firm’s internal operations system and pulled customer KYC files tied to wallet addresses. The exposed set included names, dates of birth, nationalities, passport or Singapore national ID numbers, email addresses, phone numbers and home addresses.
The data was collected by the card issuer for the Based Visa Card, a spending product that pairs with the company’s trading app and advertises up to 8% cashback.
Based has raised $11.5 million in a Series A led by Pantera Capital and says it has passed 100,000 registered users.
The number of customers affected by the breach is yet to be revealed. It is also not confirmed if any funds were moved during the incident.
Is it only Based’s card platform that was breached?
Based insists that its trading app and wallets were not affected because wallets run on a self-custody model, the platform holds no keys, and social login is handled through Privy. Its card business will continue running normally while the investigation continues
Edison addressed questions about an admin backend that had apparently leaked five months earlier. He clarified that the admin backend system was an early OpenClaw admin prototype used for internal testing in March 2026 that has since been retired. It is unrelated to the breach as it had nothing to do with the card business and held no customer data.
Edison’s post goes on to state that Based’s current priorities are supporting affected customers, tightening internal security controls and monitoring, and continuing to build out trading.
However, identity records tied to wallet addresses like the ones leaked in the Based hack can lead to “wrench attacks,” which are physical assaults and kidnappings aimed at forcing crypto holders to transfer funds. Chainalysis found that victims are often picked out using leaked data, social media or insider tips.
The Based incident is also one of a series of KYC exposures across the industry. Cryptopolitan reported that Revolut disclosed an attack in which a spoofed government email was used to pull customer identity documents and transaction histories. The attackers then demanded roughly $3 million.
The smartest crypto minds already read our newsletter. Want in? Join them.
FAQs
What data did the Based card breach expose?
According to Based's disclosure, the card issuer's KYC records may include cardholders' names, passport or national ID numbers, dates of birth, nationalities, email addresses, phone numbers and home addresses tied to wallet addresses.
When did the Based breach happen and when was it disclosed?
An unauthorized party reached the internal dashboard for the Based Visa Card program on October 5, 2026, and Based disclosed the incident on October 8.
Were Based trading accounts or funds affected?
Based said its app and wallets were not affected because wallets use a self-custody model, the platform does not hold keys, and social login is managed by Privy, so users can keep trading.
Disclaimer. The information provided is not trading advice. Cryptopolitan.com holds no liability for any investments made based on the information provided on this page. We strongly recommend independent research and/or consultation with a qualified professional before making any investment decisions.
Hannah Collymore
Hannah is a writer and editor with nearly a decade of blog writing and event reporting experience in the crypto space. At Cryptopolitan, Hannah contributes to the news page, reporting and analyzing the latest developments in DeFi, RWA, crypto regulation, AI and frontier tech industries. She graduated from Arcadia university with a degree in Business Administration.
