On-chain investigator ZachXBT alleged that crypto retirement services BitcoinIRA and iTrustCapital suffered data breaches this year without disclosing the incidents to their customers.
According to the claims, threat actors gained access to personal details including customer portfolio holdings, banking details, custodian details, and verification status. ZachXBT stated that after emailing both platforms on August 21 and receiving no response after three days, he published the alerts publicly.
iTrustCapital responded to the allegations via social media, stating that the company has not experienced and is not aware of any recent third-party vendor data breaches affecting its platform. The company added that its multi-step closed-loop system is designed to mitigate losses for clients who may be targeted or compromised at a personal level. BitcoinIRA had not responded publicly by publication time.
The exact date of the alleged breaches is unknown, though ZachXBT dates at least one attack as early as June 2026. The investigator previously wrote an August thread about a threat actor using spoofed BitcoinIRA emails allegedly acquired through a data breach.
Both companies are headquartered in California, where a state law took effect requiring businesses to notify residents within 30 days of discovering a significant data breach. Neither company appears in the state's breach registry, though the registry only publishes breaches that clear a 500-resident threshold or that a company volunteers, and BitcoinIRA also lists a subsequent Nevada base of operations.
BitcoinIRA was founded a decade ago by Chris Kline, Johannes Haze, and Camilo Concha, and claims more than $14 billion worth of assets. iTrustCapital was founded in 2018 by Todd Southwick and Blake Skadron, and its homepage claims more than $17 billion worth of transactions across over 300,000 accounts.
