Based Files Police Report After Crypto Card Data Breach; Trading Wallets Not Affected

Published October 12, 2026, 09:20 PKT. Based on Based co-founder Edison's statement reported October 12, 2026 by Odaily, KuCoin, TradingView and Binance Square, and Foresight News' earlier reporting on the Streamis unauthorized access as cited by KuCoin.

Crypto platform Based has reported a data breach affecting its crypto card business to Singapore's Personal Data Protection Commission and filed a police report, co-founder Edison said on October 12, 2026, according to an Odaily newsflash. Edison said the company's compliance and operations teams are contacting affected users and are cooperating with law enforcement on the investigation, the flash reported.

The Streamis breach

The breach traced to unauthorized access at Streamis, the entity that manages Based's crypto card business accounts, according to Foresight News' earlier reporting cited by KuCoin's flash desk. Blockchain monitoring by INSOMNIAC first flagged the unauthorized access, Odaily reported, and the result was a leak of cardholder information tied to Based's card service. Neither Foresight News nor Edison's statement disclosed how many cardholders were affected or which data fields were exposed.

Police report filed, regulators notified

Edison said the team has formally notified the Personal Data Protection Commission of Singapore and relevant regulatory authorities alongside the police report, Odaily reported. The company said its compliance and operations departments have begun reaching out to affected users directly to guide them through protective steps. The card business continues to operate normally while the investigation runs, Edison said, per the flash.

The disclosures put the incident on a regulatory clock. Singapore's Personal Data Protection Act requires organizations that discover a data breach to assess whether it is notifiable and, if it meets the threshold, to notify the PDPC and affected individuals. Based said its response protocols are already in motion, though Edison did not say whether the company considers the breach notifiable.

Trading wallets stayed isolated

Edison emphasized that Based's trading wallet and mobile app were not affected by the incident, and users can keep trading as usual, according to Odaily and KuCoin. The company attributes that isolation to its architecture: the wallet uses a self-custody model, so the platform does not hold or manage user private keys, and social login is handled by Privy, which keeps authentication separate from sensitive data, the reports said. In practice, a breach of the card account system had no path to users' on-chain funds.

The disputed admin-backend leak

Edison also pushed back on community discussion of a separate "admin backend leak" from roughly five months ago, saying it is unrelated to the current card data breach and contained no user data, Odaily reported. According to Edison, that backend belonged to an early developer version of a hosted OpenClaw product the team prototyped in March 2026 for small-scale internal testing. The team later decided not to launch it and halted development, he said.

For cardholders, the practical picture is mixed. The breach exposed card account information, but Based says the on-chain wallet layer never depended on that system, and the company is now in contact with affected users and regulators while the investigation continues.

This article is news reporting and is not investment advice.

Sources

• Based co-founder Edison's statement (October 12, 2026), primary source for the police filing, the PDPC and regulator notifications, the affected-user outreach, the self-custody architecture of the trading wallet, the Privy authentication setup, and the denial about the March 2026 OpenClaw prototype; reported via Odaily, KuCoin, TradingView and Binance Square flashes on October 12, 2026
• Odaily (October 12, 2026), secondary source for the Edison monitoring context, the INSOMNIAC flagging of the Streamis unauthorized access, and the response-protocol details
• Foresight News, via KuCoin's flash desk (October 12, 2026), secondary source for the original report that Streamis, the account manager for Based's crypto card business, suffered unauthorized access leading to the cardholder information leak
• TradingView News (October 12, 2026), secondary source corroborating Edison's statement on the law enforcement cooperation and the admin-console denial
• Binance Square news feed (October 12, 2026), secondary source corroborating Edison's statement and the Streamis unauthorized-access report