Which companies just had a verified incident, who lends to them and who owns them. Every claim carries its evidence level and its source. How we decide what is confirmed
Baanx US
financial services (crypto card program) · United States (Dover, DE entity; notices to CA and other states' residents)
What happened
Personal data on U.S. Crypto Life accounts, reached 'via a third-party service provider's access and via an internal administrative system'. Data includes name, date of birth, address, phone, email, transaction history, hashed password, encrypted MFA token and SSN. The company says it found no evidence that funds were accessed.
Forced password and 2FA reset for U.S. cardholders. The data combination (SSN, transaction history, contact details) is the kind used for targeted crypto phishing and social engineering, and the notice itself warns users about this.
What remains unknown
- count affected
- name of the third-party service provider
- whether co-branded card programs that Baanx issues for partners are affected (no evidence either way)
- why access recurred about three weeks after the first window
Losses: none stated; no evidence of fund access per company
Capital around this company
DFX holds no verified lender or owner record for this organization yet. That is a gap in our coverage, not evidence that none exists.
Sources
Does Baanx US touch your portfolio?
We map a company or a whole book against verified incidents: the lenders, owners and providers around each holding, with what is confirmed and what is not.