BasedApp, a digital asset platform serving cryptocurrency users, reported on Thursday that an unauthorized party accessed its internal systems and exposed the personal and wallet details of its clients.
Data breach details and impact
The compromise involved sensitive information, including customers’ names, dates of birth, nationalities, residential addresses, passport or Singapore national ID numbers, email addresses, phone numbers, and wallet addresses.
BasedApp shared the update on October 8, confirming that internal operations had been breached. The company has not yet disclosed how many individuals were affected, nor has it clarified if the incident led to any movement of customer funds.
BasedApp is a growing startup in the sector, recently raising $11.5 million in a Series A funding round led by Pantera Capital and surpassing 100,000 registered users.
The breach has placed new scrutiny on data protection within crypto platforms, especially as calls increase for stronger internal safeguards.
Context: UK tax authority’s proposed data access
The security incident comes as HM Revenue and Customs (HMRC), the UK’s tax authority, considers legislative changes that would expand its access to crypto user data. HMRC’s draft legislation, published as part of the Finance Bill 2026-27, seeks to revise its Schedule 36 information and inspection powers.
Under the proposal, HMRC could issue data requests to any business offering cryptoasset services, ranging from wallet software and block explorers to data vendors and hardware wallet providers. These compulsory requests would not require approval from a tribunal or consent from the affected taxpayer and would not be open to appeal.
Recap, a UK-based crypto tax software firm, submitted a response to the proposal arguing that its scope far exceeds the current Cryptoasset Reporting Framework rules in the UK.
Ben Shepheard, CTO of Recap, warned that wider data access creates risks for physical security if user information is exposed or misused. He pointed to previous cases of leaks within Europe, including insider sales of tax data and significant breaches at other crypto-tax platforms.
Recap highlighted a January 2026 incident at Waltio, a French crypto tax software provider, where a security lapse led to 50,000 users’ gains, losses, and balances being leaked, prompting ransom demands from cybercriminals.
The company has called for the pending legislation to specifically exclude wallet addresses and current crypto holdings from compulsory disclosure, arguing such details are not needed when historic sales data is already being reported. Recap also recommended that any HMRC notice should require review by a tribunal.
Mini dictionary: HMRC (Her Majesty’s Revenue and Customs) is the UK government agency responsible for tax collection, regulation enforcement, and payment of some forms of state support. Its activity in the crypto sphere focuses on enforcing tax compliance for both individuals and businesses trading or investing in digital assets.
Wider risks of crypto data leaks
Cybersecurity experts and industry analysts continue to highlight the growing danger of data breaches in the cryptocurrency sector. Such incidents extend beyond theft of digital assets and now increasingly involve threats to physical safety.
Notably, IDScan.net appeared in a cybercrime forum database that was advertised as containing more than 170 million identity documents. Large-scale breaches have also struck established firms such as Coinbase, where contractors were bribed for sensitive documents, including passport and driver’s license images.
ShipMonk, a logistics partner of hardware wallet manufacturer Trezor, was also hit by an incident impacting approximately 80,700 individuals, exposing their names and home addresses.
Rising criminal activity linked to such leaks has included violent “wrench attacks,” where victims are physically assaulted or kidnapped to force crypto transfers.
France recorded 77 cases of kidnapping, detention, and extortion involving cryptocurrency by the end of June, up from 45 throughout all of 2025. In Britain, Crimestoppers offered a £10,000 reward for information regarding a December 2025 home invasion that targeted crypto holders near Birmingham.
The ongoing debate among UK industry firms now centers on striking a balance between increased regulatory oversight and ensuring data privacy and personal safety for crypto users. As digital assets become more mainstream, the implications of data leaks point to the need for security improvements and clear regulatory standards across the industry.
