Bitcoin purchases halted after data breach puts 250,000 crypto users at risk
Israel’s largest regulated cryptocurrency broker, Bits of Gold, is investigating a data breach that potentially exposed the personal information of up to 250,000 customers.
While customer funds and digital assets remain secure, the incident prompted Israeli retail and energy giant Paz to temporarily halt Bitcoin purchases on its Yellow convenience store app.
In an Aug. 16 notice, Bits of Gold confirmed that an unauthorized party accessed a supporting data-analysis system several days earlier. The firm is Israel’s first licensed virtual asset service provider.
The potentially exposed data includes names, national identity numbers, phone numbers, email and IP addresses, bank-account details and public crypto wallet addresses.
Account passwords and identification-document images were not exposed. Bits of Gold also said it does not hold customers’ private keys, full card details or CVV codes.
This incident adds to a growing number of crypto-sector breaches in which attackers have gained access to customer information without directly compromising digital assets.
In several recent cases, the exposed data has included names, email addresses, phone numbers, physical addresses and other identifying details that can be used to target customers outside the affected platform.
That distinction limits the immediate risk of on-platform asset theft but can create longer-lasting security concerns.
This is because personal and financial information can be used in phishing campaigns, impersonation attempts, and social-engineering attacks designed to convince users to reveal credentials, approve transfers, or surrender access to self-custodied crypto.
Paz partnership paused amid vulnerability probe
Following the disclosure, Paz suspended the Bits of Gold integration on its Yellow app, according to an Aug. 17 report by CTech.
Paz said it was not concerned that Yellow customer information had leaked because the two applications lack a direct interface. The broader commercial agreement between the firms remains in effect, while Bits of Gold’s primary services continue to operate normally.
CTech attributed the Bits of Gold's data breach to an active exploit, CVE-2026-72898, affecting self-hosted releases of Metabase, an analytics software provider. Bits of Gold has since blocked access to the affected system, disconnected it from its data sources, and retained a cybersecurity incident-response firm.
The crypto-focused company also said it has notified relevant regulatory bodies, identified by Israeli media as the Capital Market Authority and the National Cyber Directorate.
Customers were advised that no technical action, such as moving funds or crypto assets, was required.
However, because contact and financial information may have been exposed, users were urged to remain alert for phishing attempts, refuse unsolicited transfer requests, and never share verification codes, one-time passwords, or private keys.