ZachXBT: BitcoinIRA and iTrustCapital concealed data breaches

Blockchain researcher ZachXBT accuses two American crypto investment platforms, BitcoinIRA and iTrustCapital, of concealing data leaks. According to him, users’ personal data, portfolio data and bank details have been leaked without the platforms disclosing this publicly. iTrustCapital denies the accusations, but on social media users are already reporting phishing emails posing as messages from the platform.

In brief:

• ZachXBT claims that BitcoinIRA and iTrustCapital were hit by data leaks this year that were not made public.
• More than $1.2 million is said to have been stolen from a BitcoinIRA user via the stolen data.
• iTrustCapital denies a data leak, but users are already receiving phishing emails in the name of the platform.

Stolen data and a $1.2 million theft

ZachXBT announced the accusations on 24 August via his Telegram channel. He claims to have examined evidence showing that both platforms fell victim to a data leak this year, but that they did not report this to users or the public.

According to the researcher, the leaked information involves personal details, portfolio statements, bank details, custodian information and the verification status of users. As a concrete example, he cites an attack in which a malicious party operating under the name ‘Tiffany’ gained access to a BitcoinIRA account through the stolen database and managed to steal more than $1.2 million. ZachXBT says he asked both companies for a response on 21 August, but had not heard anything by the time of his publication.

iTrustCapital denies, but phishing emails are already surfacing

iTrustCapital responded on 24 August via X, stating that reports of a hidden data leak are incorrect. The company says it always informs users directly in the event of a data leak. It also points to its security system, which, according to iTrustCapital, is designed to block phishing, identity theft and other forms of fraud.

Nevertheless, several users on X are showing that they have been receiving phishing emails that appear to originate from iTrustCapital. The emails were sent from the domain policy@itrustreach.com and contain, among other things, a fake message about a so-called 15% withholding tax on all assets. Users are warning each other not to click on links in such emails and to always go directly to the platform.

Whether the phishing campaign is directly linked to a possible data leak has not yet been confirmed. BitcoinIRA has so far not publicly commented on ZachXBT’s accusations.