Based co-founder Edison has responded to a data breach that exposed sensitive identity information belonging to the company’s Visa cardholders.
The incident has raised concerns about customer privacy and potential security threats involving cryptocurrency users. The company has contacted Singaporean authorities and launched efforts to support affected customers. Meanwhile, Based maintains that its trading services and self-custody wallets remain secure.
Based notifies Singapore regulators following cardholder data breach
Based co-founder Edison confirmed that the company notified Singapore’s Personal Data Protection Commission (PDPC) and filed a police report.
The breach occurred on October 5 and involved an internal operations dashboard supporting the Based Visa Card program.
An intruder accessed the company’s internal system and extracted customer Know Your Customer (KYC) records linked to cryptocurrency wallet addresses.
The exposed information included names, birth dates, nationalities, passport numbers, Singapore national identification numbers, email addresses, telephone numbers, and residential addresses.
In an October 11 post on X, Edison said compliance and operations teams had started contacting affected customers.
He added that Based was coordinating with law enforcement and relevant regulators as investigations continued.
However, the company has not disclosed how many cardholders the incident affected. Reports have also not established whether attackers transferred any customer funds.
The compromised records originated from the card issuer supporting Based’s Visa Card, which connects with its cryptocurrency trading application.
The card offers cryptocurrency spending functionality and advertises cashback rewards of up to 8%.
Based previously raised $11.5 million through a Series A funding round led by Pantera Capital.
The company also reports more than 100,000 registered users across its services.
Despite its growing customer base, Based has not provided a timeline for completing the investigation or identifying every affected account.
Based says trading app and self-custody wallets remain secure
Edison maintained that the October 5 security breach affected the card operations infrastructure rather than Based’s broader trading platform.
According to the company, its trading application and self-custody wallets remained unaffected throughout the incident.
Based explained that its wallet infrastructure operates without the company holding users’ private keys.
Furthermore, the platform relies on Privy to manage social login functionality, separating wallet access from the compromised card system.
The company plans to maintain normal Visa Card operations while investigating the incident and strengthening its internal security controls.
Edison also addressed concerns about an administrative backend that reportedly leaked five months earlier.
He identified that system as an experimental OpenClaw administration prototype developed for internal testing in March 2026.
According to Edison, Based subsequently retired the prototype, which contained no customer information and had no connection to card operations.
He said the company’s priorities include assisting affected users, improving security monitoring, and continuing development of its trading services.
However, the exposure of identity records alongside cryptocurrency wallet addresses introduces security risks beyond unauthorized financial transactions.
Blockchain analytics firm Chainalysis has warned that criminals can exploit leaked personal information to identify cryptocurrency holders for physical attacks.
Such incidents, commonly called wrench attacks, involve violence, intimidation, or kidnapping to force victims into transferring digital assets.
Chainalysis identified leaked databases, social media activity, and insider information as potential sources criminals use when selecting targets.
The Based incident follows other cryptocurrency-related identity data exposures, including a reported attack involving Revolut.
In that case, attackers reportedly impersonated government authorities through email to obtain customer identification documents and transaction histories.
The perpetrators subsequently demanded approximately $3 million, demonstrating how stolen identity records can support extortion attempts.
