On-chain investigator ZachXBT alleged this morning that BitcoinIRA and iTrustCapital suffered data breaches this year without disclosing the incidents to their customers.
ZachXBT claimed that threat actors accessed personal details from the crypto retirement services, such as customers’ portfolio holdings, banking details, custodian details, and verification status.
Once he was confident that the breaches occurred, the researcher emailed both platforms on August 21. After three days of no response, he published the alert publicly today.
iTrustCapital responded to the allegations via X, writing, “ITrustCapital has not experienced and is not aware of any recent third-party vendor data breaches affecting our platform.
“Our multi-step closed-loop system is designed to mitigate losses for clients who may be targeted, phished, scammed or compromised at a personal level.”
BitcoiIRA hadn’t responded publicly by publication time.
Who are the businesses involved?
Chris Kline, Johannes Haze, and Camilo Concha started BitcoinIRA a decade ago out of Sherman Oaks, California, according to a BBB business listing.
The company markets itself as the ‘original’ service to hold bitcoin (BTC) inside a retirement account and it has claimed more than $14 billion worth of assets.
iTrustCapital, meanwhile was founded in 2018 by Todd Southwick and Blake Skadron. It was based in Long Beach, California when it announced a $125 million Series A round in January 2022.
The company has claimed to have processed more than $10 billion in cumulative transactions across roughly 53,000 accounts, and iTrustCapital’s own homepage now claims more than $17 billion worth of transactions across over 300,000 accounts.
Read more: ZachXBT slams Bitget execs over suspicious $480M withdrawals
California breach database does not list BitcoinIRA nor iTrustCapital
Both companies have been headquartered in California, a state that recently tightened its data breach disclosure rules.
Senate Bill 446 was signed into law in October 2025 and took effect this January. This new law gives businesses 30 days to notify residents after discovering a significant data breach. A further 15 days are allowed to notify the state attorney general, once a company has notified more than 500 residents.
Neither BitcoinIRA nor iTrustCapital appears in that registry. BitcoinIRA, despite having a California address in its corporate history, also lists a subsequent Nevada base of operations that might exempt it from the requirements of this registry.
However, this registry only publishes breaches that clear the 500 resident threshold, or that a company volunteers. So, although the absence is conspicuous, it is not necessarily indicative of wrongdoing.
When the alleged breach occurred
The exact date of the data breach(es) is unknown, but ZachXBT dates at least one attack as early as June 2026.
The investigator wrote an August 10 thread about a threat actor using spoofed BitcoinIRA emails allegedly acquired through that data breach.
iTrustCapital’s own help center says that even if a client’s email, SIM card, password, or two-factor login is compromised, crypto “can not be drained from an iTrustCapital account as there is no connectivity to external wallets.”
Got a tip? Send us an email securely via Protos Leaks. For more informed news and investigations, follow us on X, Bluesky, and Google News, or subscribe to our YouTube channel.
