Based has escalated its crypto-card data breach response to law enforcement, with co-founder Edison Lim saying the company has filed a police report, notified Singapore’s data-protection regulator and begun working directly with affected customers.
The October 12 update follows an earlier disclosure involving unauthorized access to an internal dashboard used to manage the Based Visa Card program. Based says it was alerted to the unauthorized access on October 5 and contained the incident after discovery.
Some know-your-customer data collected by the card issuer may have been accessed. Based previously identified the potentially exposed fields as customers’ names, identification or passport numbers, dates of birth and addresses.
The company says card numbers, CVVs and PINs were not affected. It also says photographs of identification documents and liveness-verification images were outside the compromised dataset.
Most importantly for users holding crypto through the wider Based platform, Edison said the company’s trading wallet and app were not affected. The wallet remains self-custodial, meaning Based says it does not possess customers’ private keys.
The company also maintains that funds held for its card product remain safe and that card operations are continuing normally.
Based Has Now Brought Regulators and Police Into the Response
The October 12 update advances the incident from internal containment and customer notification into a formal regulatory and law-enforcement process.
Edison said Based’s compliance and operations teams are continuing to contact affected users, while the incident has been reported to Singapore’s Personal Data Protection Commission and other relevant authorities. A police report has also been filed, and the company says it is cooperating with law enforcement.
That regulatory step matters because Singapore imposes specific obligations on organizations handling personal information. The Personal Data Protection Commission’s data-protection rules require organizations to assess breaches and notify the regulator and affected individuals when statutory thresholds are met.
Based has not publicly disclosed how many cardholders were affected, how long the unauthorized party retained access or the exact technical weakness that enabled entry to the dashboard.
Those gaps are now among the most important unanswered questions because they determine whether the attacker merely had theoretical access to a dataset or actually extracted identifiable records belonging to a defined group of customers.
The Breach Exposed Identity Data, Not Wallet Keys
The distinction between the card system and the trading wallet is central to understanding the incident.
Based combines on-chain trading functionality with payment-card services, but those products do not necessarily share the same security architecture.
The compromised system was an internal dashboard associated with the Visa Card program. Based says the trading wallet was separate and remained unaffected because users retain custody of their own private keys.
That is materially different from incidents in which the systems responsible for moving crypto themselves are compromised. When Bitget’s backend wallet infrastructure was compromised, for example, the central question became whether attackers could manipulate the information presented to systems authorized to move funds even without directly stealing private keys.
In Based’s case, there is currently no public evidence that the card-dashboard attacker obtained signing authority over the trading wallet or the ability to transfer user crypto.
That does not make the exposed information harmless.
A name combined with a home address, birth date and government identification number can be far more useful for identity theft and targeted social engineering than an ordinary email leak.
KYC Data Creates a Different Security Problem
Crypto platforms often promote self-custody as protection against one of the industry’s most obvious risks: a company losing control of customer assets or private keys.
Based’s incident illustrates the boundary of that protection.
Self-custody can isolate the keys needed to move funds, but a payment-card product still has to interact with conventional financial infrastructure. That typically means identity verification, compliance records and operational dashboards containing information that would not otherwise need to exist in a purely pseudonymous wallet.
The result is a hybrid risk model.
A customer may control the cryptographic key to their assets while the service provider or one of its partners still holds enough conventional personal information to expose that user to impersonation, account-recovery fraud or highly tailored phishing.
The danger is particularly acute when leaked identity information can potentially be connected to known crypto activity.
Recent incidents have shown that personal-data exposure can remain relevant long after the underlying financial relationship changes. Dave Finances reported that historical Revolut customer information surfaced in the DriveWealth breach even for some users who had stopped using the broker years earlier.
Once identity data has been copied, closing an account or fixing the original access vulnerability cannot retrieve every duplicate an attacker may have made.
Why Based Is Warning About Social Engineering
Based has told affected customers to treat the relevant information as compromised and to be cautious about impersonation attempts.
That advice is more than generic breach language.
An attacker who knows a cardholder’s real name, date of birth, address and identification details can build a much more persuasive message than someone sending mass-market phishing emails.
A fake support representative could reference accurate personal information to establish credibility before asking the victim to connect a wallet, sign a transaction, disclose a recovery phrase or move assets to a supposedly secure address.
Based says official card support is handled through its in-app support channel and that team members will not service accounts through unsolicited Telegram or X direct messages.
This distinction is especially important in crypto because the second stage of an attack can be much more damaging than the original breach. Malware associated with the FomoPeek iOS crypto-theft campaign, for example, raised the far more severe prospect of exposing seed phrases and private keys directly.
Based says nothing comparable happened to its wallet infrastructure. The risk now is that personal information obtained from the card system could be used to persuade users to compromise wallets themselves.
The Old Admin-Console Claim Is a Separate Issue, Based Says
Edison also addressed discussion around a different administrator interface that had circulated publicly months earlier.
He said that system was not connected to the crypto-card breach and contained no customer information.
According to his explanation, it was an early development version of a hosted OpenClaw product created for limited internal testing in March 2026. The product was subsequently abandoned and never launched.
That clarification matters because the existence of two administrator interfaces could otherwise imply a longer-running compromise or a common entry point.
There is currently no public evidence establishing such a connection.
The stronger investigative question is therefore not whether screenshots of an old prototype exist, but what system controlled access to the live card-management dashboard on October 5 and how the attacker obtained that access.
Self-Custody Does Not Eliminate the Centralized Attack Surface
The broader lesson is uncomfortable for crypto companies trying to combine decentralized trading with conventional payments.
Users can self-custody assets, but the moment a product adds Visa cards, identity checks, customer support and compliance tooling, centralized infrastructure begins accumulating around the wallet.
Every one of those systems becomes another potential security boundary.
The private key may be perfectly protected while an administrative dashboard leaks a passport number. A smart contract may remain untouched while an attacker compromises the system used by employees to service customers. A card balance may remain safe while leaked identity information creates a future phishing risk.
This is why the absence of stolen funds should not be confused with the absence of harm.
September’s crypto security incidents demonstrated the opposite end of the spectrum, with hundreds of millions of dollars lost through hacks and exploits. Based’s incident appears much less severe financially, but it highlights a risk category that is harder to quantify because the consequences of identity exposure can emerge later.
The Next Important Disclosure Is the Technical One
Filing a police report and notifying regulators moves Based’s response forward, but it does not resolve the central security questions.
The company has yet to explain how the attacker entered the card-management dashboard, whether credentials were stolen, whether privileged access lacked sufficient authentication controls or whether a vulnerability in the application itself was exploited.
It has also not disclosed the number of affected customers or whether logs allow investigators to determine precisely which records were viewed or downloaded.
Those details matter more than whether the card service continues operating normally.
The strongest outcome for Based would be a post-incident report that identifies the access path, quantifies the exposure, describes the controls that failed and explains what has changed to prevent the same attack from succeeding again.
For customers, the immediate picture is narrower. Based says the breach touched card-related KYC information, not the self-custody trading wallet, private keys or customer funds. The company has contacted regulators, filed a police report and is cooperating with investigators.
The financial system appears to have remained intact. The unresolved risk now sits with the personal information that may already have left it.
Johan Shamshad is a financial markets writer at Dave Finances covering cryptocurrencies, trading platforms, brokers, fintech, financial regulation, and developments across global markets. He previously worked at Gulf News, adding newsroom experience to his coverage of fast-moving financial and digital-asset markets.
His work focuses on identifying market-moving events, company developments, regulatory changes, product launches, and shifts in trading and financial infrastructure.
Johan contributes news and analysis designed to help readers understand not only what happened, but why a development matters and how it may affect the wider financial landscape. You can reach out to him via his social media accounts:
Linkedin: https://www.linkedin.com/in/johan-shamshad-742851262/
X: https://x.com/Yasmine_FX
Investing: https://www.investing.com/members/contributors/279781574