The incident registry

Held funds, hacks, shutdowns and quiet policy changes at no-KYC services. Every entry has a public source, an amount where one is known, and how it ended. Unresolved serious incidents cap a service's Safety grade until they are resolved.

43
On record: 11
Unresolved or lost: $117M
Documented value

Report an incident RSS feed

All Unresolved only Outage Shutdown Policy change Funds held KYC added Data leak Hack or exploit Other Seizure

2026

21 Aug 2026

high

Data leak Pocket Bitcoin

Support-system backup exposed, including ID copies of 291 customers

Pocket Bitcoin disclosed on 21 August 2026 that a backup of its support system had been exposed. Its update of 31 August said 291 customers had bank-compliance correspondence exposed, including names, addresses, bitcoin addresses, ID copies and source-of-funds documents in varying combinations, and 5,120 customers had bank transfer lists exposed with names, addresses, amounts and some IBANs. The operator said no funds were affected.

Resolved Source: pocketbitcoin.com ↗

28 May 2026

medium

Data leak Exolix

Reported partner-API exposure of metadata for about 355,000 swaps

According to a third-party project profile and the kycnot.me event log, security research published in mid-2026 found that Exolix partner-API keys were unscoped and lacked rate limiting, exposing transaction metadata reportedly covering about 355,000 swaps and $39.5 million in volume between January 2025 and May 2026. No loss of user funds was reported. No public incident report from the company was found during this review.

Outcome unknown Source: solanacompass.com ↗

2025

1 Jun 2025

high

Data leak cock.li

Reported theft of about one million user records through retired webmail software

Security press reported in June 2025 that an attacker exploited the Roundcube webmail platform used by cock.li and offered the resulting databases for sale. According to the service's own statement as reported, records for an estimated 1,023,800 users who had logged in to webmail since 2016 were exposed, with contact entries for a further subset; passwords, email content and IP addresses were not included. The service removed Roundcube entirely.

Outcome unknown Source: bleepingcomputer.com ↗