Based Edison Updates on Crypto Card Data Leak Progress
Based Edison has issued an update on the progress of the crypto card data leak incident. The compliance and operations teams are continuously responding to affected users, and have reported the incident to the Personal Data Protection Commission (PDPC) of Singapore and relevant regulatory authorities, as well as filed a police report and are cooperating with the investigation.
On October 5, an unauthorized party accessed the internal dashboard used to manage the Based Visa Card program. The attack was quickly contained, and the attacker may have obtained some KYC data of cardholders collected by the issuing institution, including names, ID or passport numbers, birth dates, and addresses.
Card numbers, CVV, PINs, ID photos, and live detection images were not affected. The funds of the Based Visa Card are secure, and card operations are running normally. The transaction wallet and application were not affected; the wallet uses a self-custody model, and the platform does not hold user keys. Social logins are managed by Privy, allowing users to continue trading on the Based platform.
In response to external mentions of a "management backend leaked five months ago," the team clarified that this system is unrelated to the crypto card business and does not contain customer data. It was merely an early prototype of the OpenClaw management product for internal testing in March 2026, which has since been discontinued.
The current priorities are to continue supporting affected customers, tighten team security controls and monitoring, and continue building the trading experience. The attacker attempted to access deposit funds but was unsuccessful. Affected cardholders have been informed via email and reminded to guard against social engineering attacks.
In the context of crypto cards and compliance KYC scenarios, the breach of internal dashboard permissions led to the leakage of identity data, prompting regulatory notifications and police involvement. The funds and key systems were not affected, but cardholders face the risk of identity theft, and the platform must bear compliance and reputational pressure.
The platform emphasizes that support is only provided through in-app chat, and team members will not handle account issues via Telegram or X direct messages.
Source: Public Information
ABAB AI Insight
Based previously launched the Visa card product in collaboration with the issuing institution, storing user KYC data linked to on-chain wallet addresses in an internal management dashboard to meet compliance requirements. This architecture is common in many crypto card projects, and historically, similar platforms have experienced identity information leaks due to insufficient internal system permissions.
Funds and transaction paths remain self-custodied, and the platform does not hold private keys. Social logins are outsourced to Privy, with resources focused on compliance KYC and card operation systems. The motivation is to isolate funding risks while meeting issuing regulatory requirements, but the internal dashboard has become a point of data exposure.
This is similar to previous cases where certain crypto exchanges or card projects (such as some Asian and European issuing partners) experienced KYC leaks due to uncontrolled operational backend permissions. Currently, Based is in a phase of expanding card business and iterating the trading experience, requiring simultaneous tightening of security controls.
Essentially, this is an intersection of regulatory changes and technological substitution: mandatory KYC requirements centralize identity data in internal systems, and attackers obtain personal identity information linked to on-chain addresses through permission breaches, driven by insufficient compliance data storage and internal access controls.
ABAB News · Cognitive Law
Self-custody protects funds, backend leaks identity
KYC = Compliance Tax × Data Exposure
The smoother the card, the more fragile the identity