Bits of Gold, Israel’s regulated crypto broker, is investigating a cyber incident that may have exposed customer identity and financial information after unauthorized access to a third-party system used for support and data analysis.
Summary
- Bits of Gold said funds, crypto, passwords, ID scans and full card details remained unaffected.
- Potentially exposed data includes names, identification numbers, emails, phones, IP addresses and bank account details.
- Bits of Gold linked the incident to third-party software compromised during a wider global breach.
- Bits of Gold reports 300,000-plus customers and operates under Israeli financial regulation with license 56716.
- BILS received approval in April after a two-year sandbox and remains backed one-to-one by shekels.
The company notified customers on Aug. 16 and said it had blocked the access, disconnected the affected system from its information sources and informed relevant authorities, Calcalist reported.
The company said its review indicates “there may have been access to certain personal information,” including names, ID numbers, emails, phone numbers, IP addresses, bank account details and public crypto wallet addresses. It said digital assets, account passwords, scanned ID documents, full credit card details and CVV codes were unaffected. Bits of Gold also said “there is no indication” so far that the potentially exposed information has been used.
Bits of Gold links breach to a broader third-party incident
Bits of Gold said the incident formed part of a broader cyber event involving a software company it uses and other businesses worldwide. Calcalist reported that hundreds of companies may have been affected and that Bits of Gold was not believed to have been directly targeted. The software provider has not been publicly identified in the disclosures reviewed.
Reports circulating Sunday put the potentially affected customer count at roughly 200,000. That figure should be treated cautiously. The customer notice reproduced by Calcalist does not state how many records were accessed, while the company’s site says it has more than 300,000 customers. Bits of Gold has not publicly confirmed that 200,000 people were affected.
Exposed details could increase phishing risk
The main immediate risk is social engineering rather than theft from customer wallets through the reported incident itself. Names, phone numbers, emails, banking information and public wallet addresses could give attackers data for more convincing messages impersonating Bits of Gold, a bank or another financial service. Bits of Gold specifically warned customers about phishing and impersonation attempts.
The company told users not to provide passwords, verification codes or private keys and not to transfer money or digital assets in response to unsolicited approaches. The warning follows another third-party exposure in the crypto sector: as crypto.news reported, a ShipMonk breach exposed personal information belonging to 13,689 Trezor customers, prompting similar concerns about targeted phishing.
Bits of Gold operates under Israeli financial regulation
Bits of Gold operates under financial services license 56716. The company says it was the first active Israeli crypto business to receive a permanent financial services license from the Capital Market, Insurance and Savings Authority. Its website lists more than 300,000 customers, while Calcalist described it as the first currently active company among nine businesses licensed to trade cryptocurrencies by the authority.
Its regulatory profile expanded this year with BILS, a shekel-pegged stablecoin. Bits of Gold says regulators approved BILS for issuance and distribution on April 27 after a roughly two-year sandbox. As crypto.news previously reported, Israel approved the BILS shekel stablecoin after its regulatory pilot, with Bits of Gold saying each token is backed 1:1 by shekels held in reserve.
What happens next
Bits of Gold said its security team has begun a comprehensive review with a specialist cyber incident response company and continues to monitor its systems. It also said relevant authorities have been notified. Services remain operational, and the company has told customers that no account action is currently required.
The next key disclosures will be the confirmed number of affected customers, the identity of the compromised software provider, the exact scope of accessed records and whether investigators find evidence that the data was misused. Until then, the widely reported 200,000-customer figure and the full scale of the incident remain unconfirmed by Bits of Gold.
