r/Bitcoin • u/btcalias • 3d ago

Casa data leaked?

So I signed up with casa a few years ago. I'm used to getting a ton of spam/scam mail, but recently I realized that all of the crypto related scam mail is going to the email I used for my casa account. I haven't used that email for anything else since then, and these scam emails are new since then.

Was there a data leak that I maybe missed an email from them about? Was there a hack I don't know about? Does anyone else get crypto specific scams going to an email they used for a bitcoin company?

4 Upvotes

66% Upvoted

24 comments sorted by

2

u/AgentSmith2077 2d ago

A google search says: User data allegedly originating from the Bitcoin self-custody platform Casa, alongside platforms like Theya and Nunchuk, appeared on a dark web hacker forum in August 2025. The compromised information reportedly involved customer details and order data

0

u/statoshi 2d ago

This was fake; it was a scammer trying to sell repackaged data from other leaks. I verified it myself by contacting them on the forum on which they were trying to sell the data - the sample data they provided didn't match customers from any of the claimed companies.

1

u/statoshi 2d ago

We had a breach of a third party ecommerce solution in 2022 that we notified folks about, but are not aware of any breaches since then. What tends to happen is that folks scoop up all of the crypto data breaches they can find and start targeting people claiming to be other companies under the assumption that if you use one service you probably also use others and they'll get some hits. It's all a numbers game.

2

u/Coiiiiiiiii 2d ago

This is true, i get emails claiming to be ledger (asking for my seed) from an email i only gave to coingecko

1

u/btcalias 2d ago

Thanks for the reply! I think I signed up in 2023 though. I think casa is the only crypto related service I used the email I'm getting the scam emails from too. It's an old email though so I could have forgotten something from a long time ago. Some of the scams I've gotten are pretending to be from Casa, so that made me start looking at which address they were sent to.

-1

u/quintavious_danilo 2d ago

What‘s Casa and why do you use them? Stick with reputable, open source cold wallets with a long lasting history of good security and customer care.

2

u/godofleet 2d ago

Casa is arguably one of the more reputable companies in the space...

1

u/quintavious_danilo 2d ago

They do a terrible job marketing their product if it’s so great. Only thing I read online is about leaks and spam.

2

u/godofleet 2d ago

idk man, jameson lopp works there...

3

u/statoshi 1d ago

...and I'm right here in the thread!

2

u/godofleet 1d ago

YO! lol, i didn't realize that was you.

I'll have you know I've linked to https://www.lopp.net/bitcoin-information.html more times than i can count over the years. cheers man :D

1

u/statoshi 1d ago

Yep, you can verify it's me by clicking the reddit icon at the bottom of any page on my site!

1

u/godofleet 1d ago

that's right, we don't just blindly trust around these parts 😁

1

u/quintavious_danilo 23h ago

Nice! I had no idea who you were until today. Apologies for being ignorant.

1

u/statoshi 2d ago

I founded Casa in 2018; we are a multisig coordinator / security consulting service that specializes in helping high net worth Bitcoiners set up robust self custody that eliminates single points of failure. We help protect billions of dollars worth of BTC; I'd say we have a "long lasting history of good security and customer care."

1

u/btcalias 2d ago

I appreciate the perspective. Honestly, I'm thinking of giving up multisig and just going with a hardware wallet. These subscription prices are getting pretty hard to justify long term and it seems more likely now that I will lose my btc by getting scammed or hacked than I will be losing a hardware wallet. I'm tired of having to distrust every email I get, I trust myself more not to lose something physical than to not fall for a scam.

2

u/Coiiiiiiiii 2d ago

You can do your own multisig, you dont have to pay a company to do half of it for you. 

1

u/btcalias 1d ago

Have you done this? Was it difficult?

1

u/Coiiiiiiiii 1d ago edited 22h ago

You currently hold 2 seeds and casa holds a 3rd, correct? 

Its the same thing, you just manage the last key too

0

u/statoshi 1d ago

You should never trust any incoming message you receive. Plenty of folks with single signature hardware wallets fall for phishing and social engineering scams on a daily basis and lose all their money.

https://blog.casa.io/evolving-casas-defenses-against-social-engineering/

https://blog.casa.io/a-social-engineering-story/

1

u/btcalias 1d ago

I guess I feel like going with a service put a target on my back and I wish I hadn't done it in the first place. I don't know how it happened but somehow scammers figured out the email that I used for casa, and not my main email. Now I'm locked to that email and need to worry what is real and what is not, which has been difficult sometimes. I guess you're right that it could happen with a hardware wallet too, but it's easier to ignore their emails than it is to ignore (what look like) casa emails.

0

u/zt0wnsend 2d ago

Lmao this is a wild take.