Israel’s largest regulated crypto broker, Bits of Gold, disclosed on Aug. 16 that a Metabase exploit (CVE-2026-72898) potentially exposed personal data for up to 250,000 customers — including names, national ID numbers, phone numbers, emails, bank-account details and public wallet addresses — while passwords, private keys and CVV codes were not affected. Paz suspended Bitcoin purchases on its Yellow app on Aug. 17, Bits of Gold quarantined the analytics system, hired incident responders and notified regulators, warning of increased phishing and social-engineering risk even though on-platform funds remain secure.

Bearish

Predictions Markets

See what traders are focused on

View analytics →

Israel’s largest regulated cryptocurrency broker, Bits of Gold, is investigating a data breach that potentially exposed the personal information of up to 250,000 customers.

While customer funds and digital assets remain secure, the incident prompted Israeli retail and energy giant Paz to temporarily halt Bitcoin purchases on its Yellow convenience store app.

In an Aug. 16 notice, Bits of Gold confirmed that an unauthorized party accessed a supporting data-analysis system several days earlier. The firm is Israel’s first licensed virtual asset service provider.

Israel and Pakistan show crypto’s next growth phase is likely to be outside the US

New moves in Israel and Pakistan test whether crypto can move beyond exposure and into local money, banking, and payments.

Apr 29, 2026 · Liam 'Akiba' Wright

The potentially exposed data includes names, national identity numbers, phone numbers, email and IP addresses, bank-account details and public crypto wallet addresses.

Account passwords and identification-document images were not exposed. Bits of Gold also said it does not hold customers’ private keys, full card details or CVV codes.

Infographic summarizing potential Bits of Gold data exposure, the unconfirmed 250,000 ceiling, protected data and assets, Paz's Yellow feature freeze, and remaining unknowns.

This incident adds to a growing number of crypto-sector breaches in which attackers have gained access to customer information without directly compromising digital assets.

In several recent cases, the exposed data has included names, email addresses, phone numbers, physical addresses and other identifying details that can be used to target customers outside the affected platform.

That distinction limits the immediate risk of on-platform asset theft but can create longer-lasting security concerns.

Ledger customer data breached including info that leads violent criminals to your door

A third-party ecommerce compromise can doxx buyers and sharpen social-engineering attacks even when private keys remain safe.

Jan 6, 2026 · Gino Matos

This is because personal and financial information can be used in phishing campaigns, impersonation attempts, and social-engineering attacks designed to convince users to reveal credentials, approve transfers, or surrender access to self-custodied crypto.

Paz partnership paused amid vulnerability probe

Following the disclosure, Paz suspended the Bits of Gold integration on its Yellow app, according to an Aug. 17 report by CTech.

Paz said it was not concerned that Yellow customer information had leaked because the two applications lack a direct interface. The broader commercial agreement between the firms remains in effect, while Bits of Gold’s primary services continue to operate normally.

CTech attributed the Bits of Gold's data breach to an active exploit, CVE-2026-72898, affecting self-hosted releases of Metabase, an analytics software provider. Bits of Gold has since blocked access to the affected system, disconnected it from its data sources, and retained a cybersecurity incident-response firm.

The crypto-focused company also said it has notified relevant regulatory bodies, identified by Israeli media as the Capital Market Authority and the National Cyber Directorate.

Customers were advised that no technical action, such as moving funds or crypto assets, was required.

Coinbase tells users to follow ‘foolish' steps scammers use to withdraw funds from wallets

Coinciding with past breaches, Coinbase's new flow raises alarms among security experts over phishing vectors.

Mar 19, 2026 · Oluwapelumi Adejumo

However, because contact and financial information may have been exposed, users were urged to remain alert for phishing attempts, refuse unsolicited transfer requests, and never share verification codes, one-time passwords, or private keys.

The post Bitcoin purchases halted after data breach puts 250,000 crypto users at risk appeared first on CryptoSlate.

Read the article at CryptoSlate