Based co-founder Edison said the company has alerted Singapore’s data regulator and filed a police report following a recent breach.
The incident happened on October 5, and the company reported that the internal dashboard behind its Visa card program may have exposed cardholders’ names, passport numbers, birth dates and home addresses.
What update does Based have for its affected users?
In a post on X on October 11, Based’s cofounder Edison said the company’s compliance and operations staff have been contacting people whose data was caught up in the incident. The company has involved the Personal Data Protection Commission (PDPC), Singapore’s privacy watchdog, along with other regulators.
Edison said the team is coordinating with law enforcement on the case.
Cryptopolitan reported that an intruder reached the firm’s internal operations system and pulled customer KYC files tied to wallet addresses. The exposed set included names, dates of birth, nationalities, passport or Singapore national ID numbers, email addresses, phone numbers and home addresses.
The data was collected by the card issuer for the Based Visa Card, a spending product that pairs with the company’s trading app and advertises up to 8% cashback.
Based has raised $11.5 million in a Series A led by Pantera Capital and says it has passed 100,000 registered users.
The number of customers affected by the breach is yet to be revealed. It is also not confirmed if any funds were moved during the incident.
Is it only Based’s card platform that was breached?
Based insists that its trading app and wallets were not affected because wallets run on a self-custody model, the platform holds no keys, and social login is handled through Privy. Its card business will continue running normally while the investigation continues
Edison addressed questions about an admin backend that had apparently leaked five months earlier. He clarified that the admin backend system was an early OpenClaw admin prototype used for internal testing in March 2026 that has since been retired. It is unrelated to the breach as it had nothing to do with the card business and held no customer data.
Edison’s post goes on to state that Based’s current priorities are supporting affected customers, tightening internal security controls and monitoring, and continuing to build out trading.
However, identity records tied to wallet addresses like the ones leaked in the Based hack can lead to “wrench attacks,” which are physical assaults and kidnappings aimed at forcing crypto holders to transfer funds. Chainalysis found that victims are often picked out using leaked data, social media or insider tips.
The Based incident is also one of a series of KYC exposures across the industry. Cryptopolitan reported that Revolut disclosed an attack in which a spoofed government email was used to pull customer identity documents and transaction histories. The attackers then demanded roughly $3 million.
If you’re reading this, you’re already ahead. Stay there with our newsletter .
