BlockFi blockfi.com BlockFi data breach: what happened and what to do
In May 2020, attackers hijacked a BlockFi employee's phone number in a SIM swap and used it to reach customer information. BlockFi said funds, passwords, Social Security numbers and bank details were not exposed. Reports list names, emails, dates of birth, addresses and activity history.
View all 13,177 breaches- Breach date
- 14 May 2020
- Data exposed
- Names, Email addresses, Dates of birth, Physical addresses
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
BlockFi, a crypto lending company, reported that an attacker took over an employee's phone number through a SIM swap in May 2020 and used it to get into BlockFi systems. The breach was reported to Washington's Attorney General on June 25, 2020. BlockFi said the attacker tried unauthorized withdrawals that failed, and that the incident affected less than half of its retail clients and no institutional clients.
Sources checked: therecord.media, financemagnates.com, atg.wa.gov
Last verified against the official page:
What was exposed
Press reports list names, email addresses, dates of birth, postal addresses and activity history. BlockFi said no funds, passwords, Social Security numbers or bank details were exposed. No total is given on this page: the Washington filing counts about 696 Washington residents only.
What it means for you
An address plus your crypto activity is useful to scammers and, in the worst cases, to criminals who target people they think hold crypto. The practical risks are phishing and SIM swap attempts aimed at you, using real details. Security researchers warned about extortion and physical theft risk from exposed home addresses.
A note on SIM swaps
A SIM swap means a criminal convinces your carrier to move your number to their SIM, then receives your text codes. The FTC has published guidance on protecting yourself.
What to do if you were in it
- 1
Protect your phone number against SIM swaps
Add a PIN or password to your mobile account with your carrier, and use stronger authentication, such as an authenticator app or security key, on accounts that hold money or sensitive details. This follows the FTC's SIM swap guidance.
- 2
Turn on two-factor login on your crypto and email accounts
Use an authenticator app or passkey where you can. A hijacked email account lets someone reset everything else.
- 3
Ignore messages about your crypto activity
Scammers quote real account details to look legitimate. Don't click links or share codes, and go to the exchange's site yourself. See the FTC's phishing guide.
- 4
Report scams and misuse
Report fraud at ReportFraud.ftc.gov and identity theft at IdentityTheft.gov.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you when your details turn up, so you know when to repeat these steps.
Official filings
- Washington Attorney General , filed 25 Jun 2020 : 696 people
Timeline
-
The breach happened
-
Reported to the Washington Attorney General
Frequently asked
Was I affected by the BlockFi breach?
BlockFi told affected clients. It said less than half of retail clients were affected and no institutional clients.
Were my funds at risk?
BlockFi said the attacker's withdrawal attempts failed and that funds were not exposed.
What was exposed?
Press reports list names, emails, dates of birth, addresses and activity history. BlockFi said passwords, Social Security numbers and bank details were not exposed.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
