Crypto.com Accused of Hiding 2023 Breach; CEO Disputes Claims, Cites Regulatory Reports

Crypto.com CEO Kris Marszalek has denied allegations of concealing a 2023 data breach, asserting that the exchange disclosed the incident to regulators through the U.S. Nationwide Multistate Licensing System (NMLS) and “additional reports with the relevant jurisdictional regulators” Crypto.com Responds To Report On Undisclosed User Data Leak^[1]. The controversy emerged after Bloomberg and blockchain investigator ZachXBT claimed the exchange had “covered up” a phishing attack that compromised user data. Marszalek labeled these claims “misinformation,” emphasizing that the breach was reported promptly and that no customer funds were at risk Crypto.com Responds To Report On Undisclosed User Data Leak^[1].

The breach, attributed to the hacking group Scattered Spider, involved a phishing campaign targeting a Crypto.com employee in 2023. A spokesperson confirmed the incident exposed “limited Personally Identifiable Information (PII) affecting a very small number of individuals” but was contained within hours Crypto.com Responds To Report On Undisclosed User Data Leak^[1]. The exchange clarified that the breach did not impact customer funds or broader system security. However, it remains unclear whether affected users were notified or if regulatory filings were publicly disclosed Crypto.com Responds To Report On Undisclosed User Data Leak^[1].

Scattered Spider, led by 20-year-old Noah Urban, exploited stolen credentials from a United Parcel Service (UPS) database to infiltrate Crypto.com’s systems. Urban, who pleaded guilty to wire fraud and identity theft, was sentenced to 10 years in prison last month. Authorities seized $4.8 million in crypto from his devices, with restitution ordered for 30 victims out of 59 identified Crypto.com Data Breach Linked to Scattered Spider Hacker …^[3]. The group’s tactics, including SIM-swapping and social engineering, had previously compromised over 200 companies, including Twilio and Universal Music Group Crypto.com Data Breach Linked to Scattered Spider Hacker …^[3].

Crypto.com’s response to the breach highlights its focus on maintaining operational security. The company reiterated that its NMLS filings and regulatory communications were completed as required, though critics argue the lack of public disclosure to users undermines transparency. ZachXBT, a vocal critic, alleged the exchange had been breached “several times,” though Crypto.com disputes this Crypto.com Responds To Report On Undisclosed User Data Leak^[1]. The incident occurred amid broader scrutiny of crypto exchanges following Coinbase’s 2024 data leak, which exposed customer information through compromised offshore staff Previously unreported attack on Crypto.com leaked users' …^[4].

Despite the controversy, Crypto.com has pursued high-profile partnerships and expansion. The exchange recently announced a $6.4 billion Cronos (CRO) treasury with Trump Media & Technology Group, deepening ties with the Trump administration. CEO Marszalek has also signaled potential IPO discussions, citing the company’s $1.5 billion in 2023 revenue and $1 billion gross profit. The exchange’s institutional arm relaunched in the U.S. earlier this year, reflecting its strategic push into regulated markets Crypto.com Data Breach Linked to Scattered Spider Hacker …^[3].