Trust Wallet halts Transak onramp after data breach

Trust Wallet temporarily suspended Transak’s fiat-to-crypto payment service after the Miami-based firm suffered a data breach.

Editor’s note: Trust Wallet confirmed in an X post on Oct. 25 it has re-enabled Transak’s onramp service.

According to Transak’s official statement, hackers gained compromised credentials through “unauthorized access” to a third-party employee’s laptop. The sophisticated phishing tactic used against a Transak KYC vendor allowed criminals to obtain personal data like names belonging to over 92,554 users.

More than 5 million people use Transak’s service, and less than 2% of its users were impacted, per the company’s blog post on Oct. 21. The firm said it has engaged law enforcement to help in the investigation and disclosed plans to contact all affected users.

Several digital asset storage providers like Trust Wallet, Metamask, Ledge, and Coinbase employ Transak’s fiat-to-crypto or onramp payment corridor to ferry value from currencies like U.S. dollars to Bitcoin (BTC) or Ethereum (ETH).

More crypto wallet companies may pause support till the situation is rectified. Still, the firm stressed that the stolen KYC materials have not emerged as part of nefarious activities. A leading cybersecurity firm

Currently, there is no indication that the data has been misused. However, we advise affected users to remain vigilant and monitor for suspicious activity. We will be reaching out to affected users with advice and resources on protecting themselves from potential misuse of the information and offering resources such as identity monitoring services.

Transak blog post

As the startup probed the incident, ransomware syndicate Stormous claimed responsibility for the breach. Stormous apparently stole over 300 gigabytes of user data and posted illegally obtained personally identifiable information on its website. The ransomware gang also took credit for hacking web3 identity protocol Fractal ID back in July.