What BasedApp Lost
BasedApp disclosed on October 8 that an intruder had compromised its internal systems, exposing customer KYC records tied directly to crypto wallet addresses. The stolen data includes names, dates of birth, nationalities, home addresses, passport or Singapore national ID numbers, email addresses, and phone numbers. BasedApp, which reportedly raised $11.5 million in a Series A round led by Pantera Capital, claims over 100,000 registered users. It has not said how many were affected or whether any funds moved.
HMRC Wants Fewer Hoops to Jump Through
The timing is awkward for HMRC. On July 13, the tax authority published draft legislation amending its Schedule 36 information and inspection powers as part of the Finance Bill 2026-27, with the consultation window closing September 7. The proposal would let HMRC demand records from crypto service providers, broadly defined to cover wallet software, block explorers, data vendors, and hardware wallet makers, without needing tribunal approval first. That expansion in oversight echoes a separate push to treat cloud infrastructure itself as critical financial plumbing, part of a wider pattern of UK regulators reaching further into how digital finance data is stored and accessed.
UK crypto tax firm Recap filed a formal response opposing the plan the same day it was published. CTO Ben Shepheard argues the amended rule is too broad, allowing compulsory, non-appealable demands for records. Recap’s core objection is about what that data becomes once collected: linking identity directly to wallet addresses builds a permanent, traceable map of a person’s wealth, the same concern raised when Apple pushed back against a UK government demand for access to iCloud user data.
This Isn’t an Isolated Incident
Recap points to a growing list of comparable failures:
- A 2024 case in which a French tax administration employee allegedly sold declared crypto holders’ data
- A January 2026 breach at French crypto tax software Waltio exposing 50,000 users’ financial details, followed by ransom demands
- IDScan.net reportedly linked to a cybercrime forum offering 170 million identity documents
- Coinbase disclosing that a threat actor bribed support contractors to extract customer data, a tactic similar to how fraudsters previously tricked Revolut into handing over customer data through a fake government request
- A leak at Trezor’s fulfillment partner ShipMonk affecting 80,700 users
The risk isn’t only digital. Cryptopolitan has tracked a rise in violent “wrench attacks,” where victims are assaulted or kidnapped to force crypto transfers. France alone recorded 77 crypto-linked extortion cases by June, already surpassing the 45 logged in all of 2025.
Tribunal Approval, Not Just Tighter Wording
Recap wants HMRC to explicitly state that current holdings and wallet addresses aren’t “reasonably required” when historic sales data already answers the question, and to require tribunal approval before any notice goes out. The Finance Bill 2026-27 is expected to receive Royal Assent in spring 2027, which is why the window to change the wording is closing fast.
The Danger Isn’t the Breach, It’s the Map It Builds
Every one of these incidents gets covered as a standalone leak, but the real exposure compounds once identity, home address, and wallet balance sit in the same record. A single breach then does what years of blockchain analysis alone couldn’t: hand an attacker a ready-made target list of who holds how much crypto and where they live. HMRC’s proposal would make that kind of record-keeping a legal requirement across the entire UK crypto sector, not an optional risk a company chooses to take on.
Follow Hashlytics on Bluesky, Facebook, LinkedIn, Telegram and X to Get Instant Updates
