ZachXBT Reports Unreported Data Leaks at BitcoinIRA and iTrustCapital

Renowned on-chain investigator ZachXBT has uncovered evidence suggesting significant data breaches at two major U.S.-based digital asset investment platforms, BitcoinIRA and iTrustCapital. According to reports published on August 24, 2026, both companies allegedly suffered unauthorized access to sensitive user information earlier this year. Despite the severity of the compromised data, which reportedly includes financial records and personal identification, neither firm has issued a public disclosure regarding the incidents to their respective user bases.

Details of the Alleged Data Exposure

The investigation conducted by ZachXBT indicates that the leaked databases contain a comprehensive array of sensitive information. The exposure is not limited to basic contact details but extends to deep financial insights that could be leveraged for targeted cyberattacks.

The leaked information allegedly includes:

• Full personal user profiles and verification status.
• Detailed investment portfolios and asset holdings.
• Bank account details and custodial account information.
• Internal metadata related to account security.

Data leaks of this nature are particularly hazardous in the cryptocurrency sector, as they provide malicious actors with a roadmap of high-value targets and the necessary information to bypass traditional security hurdles.

Direct Financial Impact and Exploitation

The consequences of these alleged leaks have already transitioned from theoretical risks to documented financial losses. ZachXBT highlighted a specific case from June this year involving an attacker operating under the alias "Tiffany." This individual reportedly utilized the compromised BitcoinIRA database to orchestrate a targeted attack against a specific user, resulting in the theft of over $1.2 million in digital assets.

An attacker named "Tiffany" used related databases in June this year to attack a BitcoinIRA user and stole over $1.2 million.

This incident underscores the immediate physical and financial danger posed to investors when their custodial and portfolio information is exposed to the dark web or private telegram groups.

Corporate Response and Accountability

As of August 24, 2026, both BitcoinIRA and iTrustCapital have remained silent regarding these allegations. ZachXBT stated that he reached out to both organizations for official comments on August 21, but has not received a response. The lack of transparency raises concerns regarding compliance with data protection regulations, which typically require timely notification of breaches involving personal financial information.

The situation remains developing, and users of these platforms are advised to monitor their accounts closely and implement additional security measures, such as hardware security keys. The incident highlights the ongoing vulnerabilities within the Individual Retirement Account (IRA) crypto sector, where centralized platforms manage billions in retirement savings across various blockchains and tokens.