Crypto data breach: under the GDPR, compensation starts at around €100, according to Germany's top court

If a crypto provider reports a data breach, you as a customer in Germany have two rights that apply immediately: under Art. 15 GDPR you may find out which data is stored about you, and under Art. 82 GDPR you can claim compensation. Germany's Federal Court of Justice (BGH) has ruled that the mere loss of control over your own data is enough for this, and it expressly approved compensation in the region of €100 for that case. More is available if you can prove concrete damage.

The question is very practical right now. At the end of October two services from the crypto industry confirmed data breaches, and both involve information that is more sensitive for crypto investors than an email address in an online shop. This guide explains when a data breach gives rise to a claim, how to assert it and why the most important step after a breach concerns your coins, and only then the lawyer.

Data breaches at Wagyu and Chainalysis: which crypto data leaked at the end of October

The first case concerns the swap service Wagyu. A swap service exchanges one coin for another without you creating an account with identity verification: you send, say, Bitcoin to a deposit address and receive Monero (XMR) back at an address of your choice. According to the analysis by security firm Hudson Rock, reported by the trade portal Forklog on October 29, the data set comprises 38,628 order records and 10,139 unique IP addresses from July 18 to October 26, 2026. In 4,580 Monero orders marked as completed, the deposit transaction, receiving address and IP address appear together. The service's team confirmed the breach and said customer funds were not affected. The details are in our report on the Wagyu data breach.

The second case sits one level higher. In its own security notice on October 30, blockchain analytics firm Chainalysis said an attacker had accessed user IDs, full names, email addresses and job titles of the people who work with the software at the company's customers. According to the company, investigation content, passwords and session keys were not affected. Retail investors are generally not in this data set. The risk for you is indirect: real names from compliance departments are raw material for convincing phishing emails, as we described in our article on the Chainalysis incident.

Both cases show the pattern this guide is about: a provider loses data, and customers bear the consequences first.

Why a data breach weighs more heavily for crypto investors than for an online shop

A data set from an online shop reveals what you bought. A data set from the crypto industry often reveals what you own. Anyone who knows your wallet address can look up on the public blockchain which amounts sit there and when they moved. Add a name, home address or IP address, and an anonymous address becomes a person with known wealth.

This creates three risks that you should keep apart:

• Phishing: fake emails, text messages or calls that draw on real details from the breach and try to get you to enter your recovery phrase or make a "security transfer".
• De-anonymisation: the link between address and identity persists permanently. With Monero in particular, a privacy coin designed for confidentiality, a breach at the intermediary undermines the protection of the blockchain.
• Physical threat: extortion at the front door, known as "wrench attacks", requires the perpetrator to know who holds how much. On October 10 we reported more than 90 such kidnapping cases in seven months in France.

Legally, this severity matters, because it helps determine how high compensation turns out to be. In practice it means: after a breach you protect your assets first, and you deal with the money from the provider afterwards.

Art. 82 GDPR: when a data breach gives rise to a claim for compensation

The legal basis is Article 82(1) of the General Data Protection Regulation. Any person who has suffered material or non-material damage as a result of an infringement of the regulation is entitled to compensation from the controller. The controller is the company that decides on the purposes and means of data processing, so in the case of a crypto exchange, the exchange itself.

Three elements must come together for a claim:

1. An infringement of the GDPR. In a data breach, this is usually the duty under Art. 32 GDPR to protect personal data through appropriate technical and organisational measures.
2. Damage. The infringement alone is not enough. The European Court of Justice made this clear in May 2023 in case C-300/21, while at the same time rejecting a materiality threshold: even minor damage counts.
3. A causal link. The damage must result from this very infringement.

The burden of proof is important for you. The fact that unknown parties obtained data does not in itself prove that the provider breached its protection duties. That is how the ECJ ruled in December 2023 in case C-340/21. Under the same ruling, however, the provider must show that its security measures were appropriate. It is only not liable if, under Art. 82(3) GDPR, it proves that it is not in any way responsible for the incident.

BGH ruling VI ZR 10/24: loss of control is enough, the order of magnitude is €100

The most important German decision dates from November 18, 2024. Case VI ZR 10/24 concerned the 2021 Facebook scraping, in which data from around 533 million users was published. The Higher Regional Court of Cologne had dismissed the claim because the mere loss of control was not damage. The Federal Court of Justice took a different view, as its press release No. 218/2024 records.

Loss of control means: your data has fallen into others' hands, and you can no longer decide who uses it. According to the BGH, even this mere and brief loss can be non-material damage. Concrete misuse need not have taken place, and you do not have to prove any further noticeable consequences either. On the amount, the court said that, in the circumstances of that case, there were no legal objections to setting compensation for the mere loss of control in the region of €100.

Take two points from this. First, the claim is real, but small for the mere loss of control. Second, you must show that your data in particular is affected. Without proof that you are affected there is no claim, and that is exactly what you need the right of access from the next section for. The BGH also recognised that affected people can obtain a declaration that the provider is also liable for future damage. That is valuable with crypto data, because a phishing attack can come months after the breach.

Non-material and material damage: when more than €100 is possible

The difference between the two types of damage is decisive for the amount. Material damage is a measurable financial loss, such as stolen coins, the cost of a new ID document or legal fees. Non-material damage concerns well-being and daily life, such as anxiety, annoyance or the effort of constantly sorting out suspicious messages.

It can go beyond €100 if you can show more than the mere loss of control. In case C-340/21 the ECJ recognised that a well-founded fear of future misuse can itself be non-material damage. For crypto investors this fear is more plausible than in many other breaches if name, address and holdings are exposed together. A purely hypothetical risk is not enough, however. Courts require you to describe the consequences for you in concrete terms.

A list that you keep from day one therefore helps:

• every phishing email, text message or call with date, sender and content, ideally as a screenshot;
• costs you have incurred, with receipts, for example for a new hardware wallet, a new ID document or advice;
• time spent changing passwords, moving coins and correspondence;
• in the event of an actual loss, the transaction ID and the police report.

If coins are actually stolen after a breach, that is material damage equal to their value. You must then also show, however, that the theft resulted from the breach and not, say, from your own mistake in custody. How to recognise fake messages after a breach is shown in our guide to phishing after a data breach.

Right of access under Art. 15 GDPR: which data the provider must hand over

Before you claim anything, find out what is stored about you. The right of access under Art. 15 GDPR entitles you to confirmation of whether the provider processes data about you and, if so, to a copy of that data. This includes the purposes of processing, the recipients, the planned storage period and the source of the data, insofar as it did not come from you. The first copy is free.

Under Art. 12(3) GDPR the provider must respond without undue delay, and within one month at the latest. For complex requests it can extend the deadline by two months, but must tell you so, with reasons, within the first month.

For customers of a crypto exchange it pays to make the request targeted. Do not just ask for "all data", but explicitly for these points:

• which of your data is affected by the reported incident;
• whether wallet addresses, transaction data or account balances are included;
• whether ID copies, selfies from identity verification or proof of address are affected;
• to which service providers the data was passed, for example for identity verification or shipping.

Send the request by a route that proves receipt, for example by email to the address given in the privacy policy, with a copy to the data protection officer. Note the date. The response is also your most important piece of evidence if you later claim compensation.

Art. 33 and Art. 34 GDPR: the provider's notification duties after a data breach

After a breach, the GDPR requires the provider to make two separate notifications. Under Art. 33 it must generally report the breach to the competent supervisory authority within 72 hours. Under Art. 34 it must notify you as an affected person without undue delay if the breach is likely to result in a high risk to your rights and freedoms.

This notification must describe in clear and plain language what happened, what the likely consequences are and what measures the provider has taken. It must also name a contact, such as the data protection officer. An email that only speaks of a "security incident" and names no data categories hardly meets these requirements.

For you the notification has two sides. On the one hand, it proves that your data is affected. On the other, it is the fraudsters' favourite tool: after almost every major breach, fake notifications appear that lead to an "account review" on a cloned site. So check every notification through a route you know yourself, meaning the exchange's address saved in your browser, never through a link in the email.

Market location principle: does the GDPR also apply to crypto providers outside the EU?

Many crypto services are based outside the European Union. The GDPR often applies nonetheless, via the market location principle in Art. 3(2). Under it, the regulation also applies to companies without an establishment in the EU if they offer goods or services to people in the EU or monitor their behaviour in the EU. A service with a German-language interface, payment methods in euros or targeted advertising in Germany is clearly offering its services there.

The problem lies in enforcement. A provider on a Caribbean island does not pay just because a German court has ruled against it. Companies from third countries must designate a representative in the EU under Art. 27 GDPR, but many small services do not. With a swap service without an account and without a known company address, a claim on paper is often the end of the road.

This is where providers based or licensed in the EU have a tangible advantage. Anyone licensed under the MiCA regulation has an address for service in the EU and a competent supervisor you can turn to. An overview of providers with EU authorisation is in our comparison of regulated crypto exchanges. The legal position also helps on IP addresses: since 2016 the ECJ has classed dynamic IP addresses as personal data, so they fall under the protection of the GDPR.

Complaint to the data protection authority and the limitation period for compensation

Besides a civil claim, under Art. 77 GDPR you have the right to lodge a complaint with a supervisory authority. In Germany, the state data protection authorities are responsible for private companies, and you can contact the authority in your own federal state. The complaint is free. It does not bring you money, but it can trigger a fine and orders against the provider and sometimes yields information that helps you with a later claim.

For the compensation claim itself, the standard limitation period of three years under Section 195 of the German Civil Code applies in Germany. Under Section 199, this period begins at the end of the year in which the claim arose and you learned of it. For a breach you learned of in October 2026, the period therefore runs until the end of 2029. You do not need to rush anything, but you should secure evidence immediately while it is fresh.

Whether a lawsuit is worthwhile depends on the individual case. With an amount in dispute of a few hundred euros, the costs quickly exceed the gain if you lose. Legal expenses insurance with data protection cover reduces this risk. In addition, since October 2023 consumer associations have been able to enforce the claims of many affected people collectively through a redress action. In large breaches it is worth checking whether the consumer advice centre is running such proceedings.

Phishing after the data breach: custody protects your coins better than any compensation

Measured against what is at stake, €100 in compensation is little. Anyone who types their recovery phrase into a fake site after a breach may lose their entire holdings, and no court will replace them. That is why securing your assets comes before the claim.

The most important rule is this: no reputable provider ever asks for your seed phrase. The seed phrase is the sequence of usually 12 or 24 words from which all the keys of your wallet can be restored. Anyone who knows it owns your coins. Any message that asks for it is a scam, no matter how genuine the sender and design look.

If your coins are held by the provider that reported the breach, that is no reason to panic. A data breach does not in itself mean that balances are at risk. It is, however, a good occasion to check whether larger amounts need to sit on an exchange at all. With a hardware wallet, the private keys stay on a device that is not connected to the internet. Which devices are suitable is shown in our hardware wallet comparison.

If the attacker knows your wallet address, moving to a new address helps. The old address remains linked to your name in the data set, the new one does not. With Bitcoin, such a move costs a single transaction fee. Make sure you do not link the new address to your identity again through the same service. What targeted phishing after a breach looks like is shown, using the Revolut data as an example, in our article on the Revolut data breach, which also explains how the bank covered the cost of new ID documents.

Data breach compensation: secure your coins first, then claim within three years

1. Request access and secure evidence. Send the provider a request under Art. 15 GDPR with the targeted questions above, note the date and save every suspicious message. With EU-licensed providers you know where to write and which supervisor is responsible: our comparison of regulated crypto exchanges shows who holds a licence.
2. Review your custody. Larger holdings do not belong permanently on an exchange. Move them to your own hardware wallet and a new address. Our hardware wallet comparison compares devices, prices and security features.
3. Set up your everyday wallet again. For smaller amounts you move often, create a new software wallet with a new seed phrase instead of continuing to use the old address. Which app is suitable is in our software wallet comparison. You can then claim compensation calmly; the period runs for three years from the end of the year.

(As of November 2, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)