BasedApp's leak of passports tied to wallets bolsters the case against HMRC's crypto record demands

BasedApp reportedly raised an $11.5 million Series A led by Pantera Capital and says it has passed 100,000 registered users ^[5][6]. That is about $115 of venture money per registered user ^[19]. The cost of a leaked home address falls on the customer. Cryptopolitan has tracked a rise in wrench attacks, in which victims are assaulted or kidnapped until they transfer their crypto ^[18]. France counted 77 crypto-linked kidnapping, detention and extortion cases or attempts by the end of June, against 45 in all of 2025 ^[14]. The first half alone ran 32 ahead of the whole previous year ^[20].

BasedApp's file joins a run of identity leaks in the sector. Coinbase has said an attacker paid off support contractors abroad to pull customer data, passport and driver's license images among it ^[16]. In September, reports tied IDScan.net to a collection on a cybercrime forum billed as containing more than 170 million identity documents ^[17]. A leak at ShipMonk, Trezor's fulfillment partner, affected roughly 80,700 users ^[13].

Recap's case is that HMRC's draft adds more places where such records sit. Its filing cited a 2024 case in which a French tax administration employee allegedly sold the names, addresses and wallet balances of declared crypto holders ^[11]. It also cited the January 2026 breach at Waltio, a French crypto tax software provider, where 50,000 users' gains, losses and balances were exposed and a hacking group then sent ransom demands ^[12]. Both leaks paired identity with holdings. Recap says the draft reaches much wider than the UK's existing Cryptoasset Reporting Framework rules ^[10]. HMRC is not relying on that framework alone. Its draft adds a compulsory notice that needs no taxpayer consent and cannot be appealed ^[9].

The Finance Bill 2026-27 text can go three ways ^[7]. HMRC can adopt Recap's first ask, its second, or neither ^[15]. I think the BasedApp file argues for narrowing what a notice collects more than for a tribunal gate. A tribunal decides whether a notice issues. It does not cut the number of fields collected or the number of places they are stored afterward, and BasedApp's leak came out of KYC records the company held for its own customer checks ^[2].

The counter-thesis is that the breach says little about HMRC. BasedApp would have held the same file with or without a Schedule 36 notice, and calling the incident the exact harm Recap cites is Cryptopolitan's framing ^[1]. The ShipMonk case is the one that would prove my view wrong. Attackers got names and home addresses from that exploit ^[13], and a list of where hardware wallet buyers live is a target list without any wallet address attached. If the French cases trace back to leaks of that kind, keeping wallet addresses out of HMRC's demands protects holders less than Recap's wording assumes.