Tokensoft Data Breach
The 2022 Tokensoft data breach occurred when an internal audit and airdrop compliance dataset from Tokensoft (tokensoft.com), a leading institutional platform for compliant digital asset sales and token distribution, was exfiltrated in November 2022 and circulated across hacking forums.
Exposed Data Types
6- Email addresses
- Names
- IP addresses
- Geographic locations
- Crypto wallet addresses
- KYC status
About This Breach
What information was affected in the Tokensoft incident?
The leaked file (tokensoft bad actors.csv) cross-references Web3 participants with their on-chain addresses and offline identities. The breach compromised records for 4,338 unique participants, exposing:
- Blockchain & Wallet Identifiers: Ethereum and EVM-compatible public wallet addresses (wallet_address, softdrop wallets).
- Identity & KYC Records: Full legal first and last names, KYC verification completion statuses, and internal identity verification UUIDs.
- Contact & Network Telemetry: Canonical email addresses, connection IP addresses, auxiliary network nodes, and wallet clustering metrics.
- Geographic Identifiers: Country codes and municipal regions.
How many accounts were affected?
Strict RFC canonical parsing and deduplication confirmed 4,338 unique valid participant email addresses.
Technical analysis and security risks
Doxxing cryptocurrency wallet addresses with real-world identities and IP addresses completely strips participants of on-chain pseudonymity. This exposes crypto holders to targeted phishing, malicious smart contract signing lures, and targeted social engineering scams.
Recommended actions for affected users
Participants involved with Tokensoft token allocations should:
- Consider migrating high-value assets from exposed wallet addresses to new hardware wallets.
- Exercise extreme caution when prompted to sign smart contract approvals from email notifications.
- Implement hardware-based multi-factor authentication (MFA / 2FA) across all email and exchange accounts.
Verification and editorial method
LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.
Report missing or incorrect information
