Crypto retirement platforms BitcoinIRA and iTrustCapital accused of failing to disclose data breaches
Investigator alleges data breaches at crypto retirement services
On-chain investigator ZachXBT has accused two crypto retirement platforms, BitcoinIRA and iTrustCapital, of suffering data breaches in 2026 without informing their customers. According to ZachXBT, threat actors accessed sensitive personal details from both services, including customers’ portfolio holdings, banking information, custodian details, and verification status.
ZachXBT said he emailed both companies on August 21 after confirming the breaches. After receiving no response for three days, he made the allegations public on August 24.
Companies respond differently to allegations
iTrustCapital responded to the claims on X (formerly Twitter), stating: “ITrustCapital has not experienced and is not aware of any recent third-party vendor data breaches affecting our platform.” The company added that its system is designed to protect clients even if their personal login details are compromised.
BitcoinIRA had not issued a public response by the time of publication.
What information may have been exposed
- Customers’ portfolio holdings
- Banking details
- Custodian information
- Verification status
Background on the companies
BitcoinIRA was founded in 2016 by Chris Kline, Johannes Haze, and Camilo Concha in Sherman Oaks, California. The company markets itself as the first service to allow bitcoin to be held in a retirement account and claims to manage over $14 billion in assets.
iTrustCapital was founded in 2018 by Todd Southwick and Blake Skadron. Based in Long Beach, California, the company says it has processed more than $17 billion in transactions across over 300,000 accounts.
California’s data breach disclosure rules
Both companies are based in California, which recently strengthened its data breach disclosure laws. Under Senate Bill 446, businesses must notify affected California residents within 30 days of discovering a significant data breach. If more than 500 residents are affected, the state attorney general must also be notified within 15 additional days.
Neither BitcoinIRA nor iTrustCapital appears in California’s public breach registry. However, the registry only includes breaches affecting more than 500 residents or those voluntarily reported by companies. BitcoinIRA also operates in Nevada, which may affect its disclosure obligations.
Timeline of the alleged breaches
The exact dates of the breaches are unclear, but ZachXBT suggested at least one attack occurred as early as June 2026. On August 10, he posted about a threat actor using fake BitcoinIRA emails, which he claimed were obtained through the breach.
What iTrustCapital says about security
iTrustCapital’s help center states that even if a client’s email, password, or two-factor authentication is compromised, crypto assets cannot be drained from an account because the platform does not connect to external wallets.
What is confirmed
- ZachXBT has publicly accused BitcoinIRA and iTrustCapital of data breaches in 2026.
- iTrustCapital denies experiencing any recent data breaches affecting its platform.
- Neither company appears in California’s public breach registry.
- ZachXBT reported the issue to both companies on August 21 before going public.
What remains unclear
- Whether the alleged breaches actually occurred.
- The exact dates and scope of the breaches.
- How many customers may have been affected.
- Why neither company appears in California’s breach registry, if breaches did occur.
- BitcoinIRA’s official response to the allegations.
Why this matters for crypto retirement account holders
If the allegations are true, customers of these platforms may have had sensitive financial and personal information exposed without their knowledge. This could increase the risk of identity theft, phishing attacks, or other fraud. The situation also highlights the importance of data security and transparency for companies handling crypto retirement accounts.
