Overview

• CEO Kris Marszalek said the company filed a Notice of Data Security through the NMLS and notified relevant regulators, describing exposure of limited PII for a very small number of individuals and no risk to customer funds.
• Bloomberg reported the incident as previously unreported to the public and tied it to Scattered Spider, alleging hackers impersonated staff to obtain employee credentials and access an internal account.
• Investigators linked the activity to Noah Urban, who pleaded guilty in April and was sentenced last month to 10 years in prison, with authorities seizing about $4.8 million in crypto and ordering roughly $13 million in restitution.
• On‑chain investigator ZachXBT criticized Crypto.com for not publicly notifying affected users and for lacking transparency, as the number of impacted users and specific data fields remain undisclosed and no independent forensic report has been published.
• Crypto.com’s Cronos (CRO) token fell about 10% over the past day during broader market volatility as the disclosure dispute drew renewed scrutiny of exchange reporting standards.