Based alerts Singapore's regulator after card dashboard exposes passport data tied to wallets

Based's defence is that nothing was taken that could be spent, and on the company's description that may hold: the platform holds no keys, and the wallets are self-custody ^[15]. The file is a different asset. It puts a passport number and a home address beside a wallet address, and once they sit together, we think the file hands an attacker a person to find and an address to look up. Chainalysis found that victims of "wrench attacks" are often picked out using leaked data, social media or insider tips ^[9], and of those three routes only the first arrives already assembled.

Based disclosed the incident on October 8, three days after the breach ^[2][13]. Edison's update came six days after it ^[14]. Cryptopolitan reports that the number of customers affected has yet to be revealed ^[5], so no one outside the company can size the file.

Edison listed three priorities: supporting affected customers, tightening internal security controls and monitoring, and continuing to build out trading ^[7]. The company said the card business will keep running normally while the investigation continues ^[8]. In our view that means new applicants keep handing over passports to a system whose controls are still being tightened.

We think the extortion and targeting risk is real but unproven. In the best case the file never circulates and nothing follows; worse outcomes run from extortion messages sent to individual cardholders to someone being approached physically. That best case would show we overweighted the exposure. Cryptopolitan's account does not describe a demand made to Based or an attack on one of its cardholders.