Hackers hit a Bits of Gold vendor and swept up 200,000 Israeli crypto customers

Bits of Gold's vendor breach shows crypto security doesn't stop at the wallet anymore. The coins can be safe while the customer data around them is still exposed.

Nobody had to break into Bits of Gold's core systems for this to become a serious problem. The Israeli crypto broker disclosed on August 16 that an attacker compromised an outside software vendor and reached customer records from there. It's a long list. Names, national ID numbers, emails, IP addresses and phone numbers were exposed, along with some bank account details and public wallet addresses.

The company has said funds, coins, passwords, ID scans and full card numbers weren't touched. That's important. It also isn't the end of the story.

Bits of Gold's own help center says the company has more than 200,000 registered clients around the world, and its website presents the business as a regulated Israeli crypto provider operating under local supervision. That makes this breach more awkward than a routine support-tool leak. The whole offer is trust: a local, regulated route into crypto for people who don't want to manage every risk alone.

If your bitcoin or ether didn't move, you may be tempted to treat the incident as a near miss. Don't. A national ID number, phone number and wallet address are not keys to an account, but they are useful to the wrong person. They help scammers sound credible. They help phishing messages look personal. They let an attacker connect a real name with a crypto habit.

That is enough damage.

The weak spot was outside the exchange

The sharpest part of this story is where the breach appears to have happened. Bits of Gold was hit through a vendor, not through the kind of direct exchange hack most customers imagine when they hear about crypto crime. That distinction matters because it shows where the industry is still soft. Custody systems, cold wallets and withdrawal controls have taken years of attention. The software sitting around the edges of the business has not always had the same discipline.

Bits of Gold says it brought in a specialist cyber incident response firm, notified the relevant Israeli regulators and kept services running. Customers were told no immediate action was required. That is a reasonable operating message if passwords and assets were not exposed, but it shouldn't make anyone casual about the data that was.

You can't rotate your national ID number the way you rotate a password. You can't make an old phone number disappear from a leaked database once it has been copied. That is why vendor security matters so much in crypto. The money may sit behind serious controls, but the customer's identity often moves through order systems, support tools, compliance workflows and third-party software that was never built with the same threat model.

Hardware wallet firms are seeing the same pattern

This isn't only a Bits of Gold issue. The Financial Times reported this week that nearly 14,000 Trezor customers had personal information exposed through one of the hardware wallet maker's shipping providers. The compromised data included names, addresses, phone numbers and emails for 11,742 customers, with another 1,947 affected to a lesser extent. Trezor said it was not aware of fraud or physical threats resulting from the exposure.

That example cuts close to the same problem. Trezor's devices were not suddenly broken. The weakness sat in the delivery chain around them. If you buy a cold wallet to protect private keys, you still have to give someone a shipping address. For a crypto holder, that address can become sensitive information by itself.

Frankly, this is where crypto companies need to stop congratulating themselves too early. Keeping coins safe is the minimum job. Keeping the customer map away from attackers is part of the same job, even when that map lives inside a vendor's system.

Bits of Gold's investigation is still open, and the attacker has not been publicly identified. The practical lesson is already plain enough. If you use the service, watch for messages that know too much about you, especially anything asking you to move funds, reset access or verify wallet details. Real attackers don't need your password when they can use your leaked identity to talk you into giving them the next step.

The funds stayed fenced off. The personal data did not. For a regulated crypto broker, that gap is now the story.

Also read: Crypto's Bill Odds Crash to 19% Just as CEOs Head to the White House • SafePal Confirms Data Breach Exposed Order Details of Nearly 40,000 Users • Tether Got Its First Full KPMG Audit and Still Won't Show You the Report

Source