A major security lapse has hit crypto betting platform Shuffle after an external vendor handling user communications was compromised, exposing personal data tied to most of its customer base.

Founder Noa Dummett said in a post on X that the incident originated from Shuffle’s customer relationship partner, Fast Track, which managed automated emails and user messaging. While the exact data exposed wasn’t specified, Dummett acknowledged that a “majority” of users were affected and that an internal probe is underway to determine how far the information has spread.

The company plans to replace its CRM provider and review how much access third-party systems have to its infrastructure. Shuffle ranks among the top 15,000 most-visited sites globally, according to SimilarWeb – suggesting the scale of the breach could be significant.

Crypto’s Persistent Data Problem

The Shuffle compromise adds to a growing list of data-related incidents across the crypto sector. Even when only contact details are leaked, attackers can weaponize that data for phishing schemes or social engineering, often resulting in irreversible crypto losses.

In recent months, platforms such as Discord, Bitcoin Depot, and even Coinbase-linked service providers have all reported leaks or unauthorized disclosures. The incidents highlight that even indirect connections to crypto firms can become attack vectors.

Beyond Digital Theft

Security experts warn that breaches like these carry physical risks, too. Exposed crypto holders can become targets of “$5 wrench attacks” – crimes involving coercion or assault to extract wallet passwords. The issue has grown severe enough that custody providers now cite rising demand from users seeking off-chain protection.

The Shuffle breach is yet another reminder that the weakest link in crypto security isn’t always the blockchain itself, but the human and corporate systems surrounding it.