Bits of Gold Probes Cyber Incident; Customer Data May Have Been Exposed

Bits of Gold, one of Israel's largest regulated crypto brokers, is investigating a cyber incident tied to unauthorized access to a third-party system it uses for customer support and data analytics. The company says the intrusion may have exposed certain customer identity and financial details. In a customer notice dated Aug. 16, Bits of Gold said it contained the incident, isolated the affected system from its information sources, and notified the relevant authorities, according to Calcalist. Based on its review to date, the firm said "there may have been access to certain personal information," including names, ID numbers, email addresses, phone numbers, IP addresses, bank account details, and public crypto wallet addresses. Bits of Gold said it has found no evidence that highly sensitive items were compromised, citing customers' digital assets, account passwords, scanned ID documents, full credit card numbers, and CVV codes as unaffected. The company also said there is currently "no indication" the potentially exposed data has been misused. The firm described the breach as part of a wider cyber event involving a software provider used by Bits of Gold and other companies globally; the provider has not been publicly identified. Calcalist reported that hundreds of businesses may have been impacted and that Bits of Gold was not believed to have been directly targeted. Some media reports circulating Sunday suggested roughly 200,000 customers could be affected. That figure remains unconfirmed: the customer notice cited by Calcalist does not state how many records were accessed, and Bits of Gold, whose website lists more than 300,000 customers, has not validated the 200,000 estimate. Bits of Gold said the most immediate risk is social engineering. Details such as names, phone numbers, emails, bank information, and public wallet addresses can make phishing and impersonation attempts more credible. The company warned customers not to respond to unsolicited requests for passwords, verification codes, or private keys, and not to transfer money or crypto in response to unexpected outreach. It also urged vigilance for phishing messages posing as communications from Bits of Gold, banks, or other financial services providers. The incident comes amid ongoing concerns about third-party exposures in the crypto sector. It follows a separate supplier-related breach involving ShipMonk that exposed personal data of 13,689 Trezor customers, underscoring how vendor compromises can cascade across crypto ecosystems. Bits of Gold operates under financial services license 56716 and says it was the first active Israeli crypto company to receive a permanent license from the Capital Market, Insurance and Savings Authority. The firm's website cites more than 300,000 customers. Earlier this year, Bits of Gold expanded its regulatory footprint with BILS, a shekel-pegged stablecoin it says is backed 1:1 by shekel reserves and was approved for issuance and distribution after a roughly two-year regulatory sandbox. The company said its security team has launched a full review with a specialist cyber incident response firm, is monitoring systems closely, and has notified regulators. Services remain operational, and it said customers do not need to take immediate account actions. Key outstanding questions include confirmation of the number of affected customers, identification of the compromised software provider, the precise scope of accessed records, and whether investigators find evidence of misuse. Until those disclosures are made, the scale of the incident remains unverified.