Summary
Bits of Gold, Israel's largest regulated cryptocurrency broker with more than 250,000 customers and a Financial Services Provider license, disclosed on August 16, 2026 that an unauthorized party accessed a third-party analytics system and may have obtained personal data belonging to approximately 200,000 customers. The exposed data includes names, national ID numbers, email addresses, phone numbers, IP addresses, bank account details, and public cryptocurrency wallet addresses. Customer funds, private keys, passwords, CVV codes, and ID document scans were not involved. Israeli media attributed the breach to CVE-2026-72898, an active exploit affecting self-hosted releases of Metabase, an analytics software provider. Bits of Gold said the incident is part of a broader global cyber event that affected other companies simultaneously. The company disconnected the affected system, retained a cybersecurity incident response firm, and notified the Capital Market Authority and the National Cyber Directorate. Israeli retail and energy conglomerate Paz temporarily halted Bitcoin purchases through its Yellow convenience store app as a precautionary measure. The Bits of Gold breach is the third significant crypto data breach in seven days, following the SafePal breach that exposed nearly 40,000 customer order records and the Trezor breach via shipping partner ShipMonk that exposed 14,000 customer records.
Timeline
| Date | Event |
|---|---|
| Aug 13, 2026 | Trezor discloses breach via shipping partner ShipMonk — 14,000 customer records exposed |
| Aug 16, 2026 | SafePal discloses breach — nearly 40,000 customer order records exposed |
| Aug 16, 2026 | Bits of Gold detects unauthorized access to third-party analytics system — disconnects and retains incident response firm |
| Aug 16, 2026 | Paz halts Bitcoin purchases on Yellow app as precautionary measure |
| Aug 16, 2026 | Bits of Gold notifies Capital Market Authority and National Cyber Directorate |
| Aug 17, 2026 | Bits of Gold publicly discloses breach — approximately 200,000 customers potentially affected |
| Aug 18, 2026 | CVE-2026-72898 Metabase exploit attributed as likely attack vector by Israeli media |
Domain Intelligence
| Domain | Score | DKIM | SPF | DMARC | Status |
|---|---|---|---|---|---|
| bitsofgold.co.il | 58.15 | ✓ | ✓ | ✓ | Live |
Context
bitsofgold.co.il scores 58.15 — a low-trust range score for Israel's largest regulated crypto broker, reflecting accumulated signals that the WarmBadge engine surfaces without editorial adjustment. Founded in 2013 as the first Israeli crypto company to receive a permanent Financial Services Provider license, Bits of Gold holds SOC 2 Type 2 certification. The score reflects the domain's current trust profile, not its regulatory status or operational history.
Three crypto data breaches in seven days — SafePal, Trezor via ShipMonk, Bits of Gold — share a common thread: the breach in each case occurred not at the core wallet or exchange infrastructure but at a peripheral vendor. A shipping provider, an analytics platform, an order management system. The cryptographic security of the wallets was not touched in any of the three incidents. What was touched was the customer data layer that surrounds those wallets. Names, addresses, phone numbers, ID numbers, bank account details. That data enables physical attacks, targeted phishing, and impersonation campaigns against known cryptocurrency holders. The coins stayed safe. The customers did not.