BitcoinIRA and iTrustCapital accused of concealing data breaches

On-chain investigator ZachXBT has alleged that crypto retirement services BitcoinIRA and iTrustCapital suffered data breaches this year without notifying their customers. According to the allegations, threat actors accessed sensitive personal information, including customer portfolio holdings, banking details, custodian information, and verification status.

iTrustCapital denied the claims on X, stating the company is not aware of any recent third-party vendor data breaches affecting its platform. The company noted that its closed-loop system is designed to mitigate losses for clients who may be compromised at a personal level. BitcoinIRA had not provided a public response at the time of the reports.

Both companies have ties to California, a state that recently implemented Senate Bill 446, requiring companies to notify residents of significant breaches within 30 days. Currently, neither company appears in the California state data breach registry.