TLDR
- Crypto.com firmly denied allegations of concealing a 2023 data breach from US regulators and authorities
- Scattered Spider hacker Noah Urban accessed employee account through phishing, exposing limited user personal data
- No customer funds were compromised during the security incident, which was contained within hours
- CEO Kris Marszalek called breach cover-up claims “misinformation” from uninformed sources
- Urban received 10-year prison sentence for hacking 13 companies, including the Crypto.com attack
Cryptocurrency exchange Crypto.com has strongly disputed claims that it failed to disclose a 2023 data breach to federal regulators. The controversy emerged after Bloomberg revealed details about a cyberattack that exposed personal information from a small number of users.
The security incident involved Noah Urban, a teenage member of the Scattered Spider hacking group. Urban and an accomplice known as “Jack” successfully compromised a Crypto.com employee’s account through a targeted phishing attack.
The breach occurred sometime before March 2023. During the attack, hackers gained access to limited personally identifiable information (PII) from a small group of users. However, the exchange emphasized that no customer funds were accessed or placed at risk.
Crypto.com detected the phishing campaign targeting its employee and contained the incident within hours. The company’s spokesperson confirmed they filed proper notifications with the US-based Nationwide Multistate Licensing System and other jurisdictional regulators.
Crypto Exchange Security Breach Response
CEO Kris Marszalek addressed the controversy directly on social media platform X. He called suggestions that Crypto.com failed to report the security incident “completely unfounded” and accused critics of spreading misinformation.
Blockchain investigator ZachXBT had criticized the exchange on X, claiming Crypto.com “covered up a breach that impacted the personal information of users.” ZachXBT also alleged the platform had been “breached several times.”
The exchange maintained it properly disclosed the incident through official regulatory channels. A company spokesperson told Bloomberg the breach affected personal information of “a very small number of individuals” with no customer fund exposure.
Criminal Prosecution and Industry Impact
Noah Urban was arrested in January 2024 following an FBI raid that seized $4 million worth of cryptocurrency assets. The raid also recovered hundreds of thousands of dollars in cash and jewelry from the cybercriminal.
Urban pleaded guilty to charges involving attacks on 13 different companies. He received a 10-year prison sentence for his role in the cybercriminal activities targeting technology and cryptocurrency companies.
The Scattered Spider group has become known for targeting employees at telecommunications, technology, and crypto firms. These social engineering attacks often focus on gaining access to sensitive customer data through compromised staff accounts.
Crypto.com has experienced growth in trading volume compared to other USD-backed cryptocurrency exchanges. The platform processed more volume than Coinbase in August 2025, according to industry data. The exchange recently partnered with Trump Media & Technology Group to establish a digital asset treasury focused on CRO tokens.
