---
title: "Baanx Crypto Life account-data incident"
description: "Baanx US Corp. reported unauthorized access to US Crypto Life account information around September 23–28 and again around October 17, 2026."
incident_type: "Cybersecurity incident"
status: "active"
last_modified: "2026-11-04"
canonical_url: "https://www.ally.security/incidents/baanx-crypto-life-account-data-incident-2026"
markdown_url: "https://www.ally.security/incidents/baanx-crypto-life-account-data-incident-2026.md"
stix_url: "https://www.ally.security/incidents/baanx-crypto-life-account-data-incident-2026/stix.json"
---

# Baanx Crypto Life account-data incident

Baanx US Corp. reported unauthorized access to US Crypto Life account information around September 23–28 and again around October 17, 2026.

Last modified Nov 4, 2026 · 1 source

## Summary

- **Environment:** US Crypto Life accounts and administrative access
- **Operational impact:** Personal information and protected authentication data potentially affected
- **Financial impact:** No incident cost disclosed

## What happened

[Baanx US Corp.](https://baanx.com/) reported unauthorized access to US Crypto Life account information around September 23–28 and again around October 17, 2026. [1](#source-1)

## Impact

Potentially affected fields included identity and contact details, transaction history, Social Security numbers, hashed passwords and encrypted multi-factor authentication tokens. Baanx reported no evidence that customer funds were accessed. [1](#source-1)

## Timeline

### October 30, 2026 — Customer notification letter dated

Customer notification letter dated, according to the published account. [Incident notice](https://oag.ca.gov/system/files/Baanx%20US%20Corp%20-%20Notification%20Letter.pdf). [1](#source-1)

### November 4, 2026 — Briefing updated

This briefing was last reviewed and updated on November 4, 2026.

## Threat Group & Attack Vector

Access involved a third-party provider and an internal administrative system. The notice does not map each route to a particular access window. [1](#source-1)

### Actors

- No threat actor group has been identified in the reviewed public evidence.

### TTPs

- No specific MITRE ATT\&CK technique is currently mapped for this case.

## Response

Baanx contained access, reset account passwords and two-factor authentication, and offered two years of identity protection and credit monitoring. [1](#source-1)

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/baanx-crypto-life-account-data-incident-2026/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### Baanx US Corp. data security notice

official · Baanx US Corp. · Oct 30, 2026

<https://oag.ca.gov/system/files/Baanx%20US%20Corp%20-%20Notification%20Letter.pdf>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Resulted In · 100% confidence · current**  
   Baanx Crypto Life account-data incident: Potentially affected fields included identity and contact details, transaction history, Social Security numbers, hashed passwords and encrypted multi-factor authentication tokens. Baanx reported no evidence that customer funds were accessed.
2. **Resulted In · 100% confidence · current**  
   Baanx Crypto Life account-data incident: Baanx contained access, reset account passwords and two-factor authentication, and offered two years of identity protection and credit monitoring.
3. **Resulted In · 100% confidence · current**  
   Baanx Crypto Life account-data incident: Baanx US Corp. reported unauthorized access to US Crypto Life account information around September 23–28 and again around October 17, 2026.
4. **Resulted In · 100% confidence · current**  
   Baanx Crypto Life account-data incident: Customer notification letter dated
5. **Affected Organization · 100% confidence · current**  
   Baanx Crypto Life account-data incident: Baanx US Corp.
6. **Resulted In · 100% confidence · current**  
   Baanx Crypto Life account-data incident: Access involved a third-party provider and an internal administrative system. The notice does not map each route to a particular access window.
7. **Occurred At · 100% confidence · current**  
   Customer notification letter dated: 2026-10-30

</details>