Based co-founder Edison confirmed the company has reported its crypto card data breach to the Personal Data Protection Commission and filed a police report following unauthorized access to an internal dashboard on October 5. The attacker potentially obtained KYC data collected by the card issuer, including names, ID numbers, dates of birth, and addresses. The compliance team is actively responding to affected users while the crypto card business continues normal operations. Trading wallets and the Based app remain fully operational and unaffected by the incident. The platform utilizes a self-custody model where it does not hold user keys, and social login services are managed by Privy. Based also clarified that claims regarding an admin backend leak five months ago refer to a discontinued OpenClaw prototype from March 2026 that contained no customer data and was unrelated to the crypto card business. Current priorities include supporting affected customers and strengthening security controls.