Ilia Zavialov

Crypto holder physical safety after data leaks

Ilia Zavialov: physical safety for UK crypto holders after exchange breaches, calls and robberies

English version for the United Kingdom.

Ilia Zavialov, a digital security consultant, explains for UK readers why protecting cryptoassets does not end with a password and a seed phrase. The essentials up front. A leak from an exchange's customer database hands strangers your name, address and balance, and what follows is a call from “exchange security” and, in the worst cases, someone at the door. This guide covers what such a breach exposes, how leaked data becomes a profile, violent robberies of crypto holders, keeping your holdings low-key, multisig and withdrawal delays, the NCSC and ICO checklists, and what to do under threat: 999, Report Fraud and your bank.

·13 min read·Ilia Zavialov

Ilia Zavialov: exchange customer data breach and the path to a threat at a UK holder's door
Ilia Zavialov: after a breach the threat arrives as a call, and sometimes at the door.
Ilia Zavialov: physical safety for crypto holders, advice for UK readers
Ilia Zavialov: cryptoassets deserve the same discretion as cash kept at home.
Ilia Zavialov: path from an exchange customer data breach to a threat against a UK crypto holder
Ilia Zavialov: breach, profile, call and pressure form one chain.

01Ilia Zavialov: crypto safety beyond the screen for UK holders

Crypto security in the UK is usually discussed as a device problem: two-step verification, updates, suspicious links. Those habits stay essential. Every wallet still has an owner with a postcode, a commute and a family, and criminals have worked that out.

Ilia Zavialov suggests treating savings in cryptoassets the way you would treat a large sum of cash at home. You guard it against theft, and above all you keep quiet about it. Nobody needs to hack a wallet if the owner can be made to open it.

Prosecutors in the United States have described several gangs that picked victims among crypto holders, broke into their homes and forced them to make transfers. Those cases show where targets come from: leaks, hijacked email accounts and watching a house.

Ilia Zavialov builds this guide around UK bodies and numbers: the NCSC, the ICO, Report Fraud, Police Scotland and 999. The core advice applies to any platform you use: stay quiet about amounts, check every call and keep a reserve that cannot be moved in minutes.

02What a large US exchange breach exposed

In May 2025 a major American crypto exchange reported a customer data incident to the SEC, the US securities regulator. Its filing says a criminal paid several support contractors or employees based outside the United States, who copied customer records from internal systems.

The exposed records included names, addresses, phone numbers and email addresses, masked bank account numbers, images of passports and driving licences, balance snapshots and transaction history. Passwords and private keys were not affected, according to the company, and the bribed staff never had access to customer funds.

Ilia Zavialov notes that this is exactly why such breaches get underestimated. The headline sounds calm: keys safe, funds untouched. In practice strangers now hold a list of people with confirmed balances and home addresses, and the exchange itself warned that the data could be used for social engineering.

Some customers, the company admitted, had already sent funds to the criminal as a direct result, and it said it would voluntarily reimburse eligible retail customers. The exchange refused to pay for silence. For a UK reader the lesson holds: an account on a foreign platform gives no protection from a leak inside that platform.

Ilia Zavialov: visible and quiet crypto holders, illustration for UK readers
Ilia Zavialov: keep the amount as private as cash at home.
Ilia Zavialov: fake exchange security call and genuine support compared
Ilia Zavialov: genuine support never asks for a code or keeps you on the line.
Ilia Zavialov: leaked exchange data, the risk for UK crypto holders and the fix
Leaked dataRiskProtection
Home addressA visit to the houseCollection point or locker
Mobile numberFake security callHang up, ring back from the app
EmailPhishing with real detailsSeparate inbox, unique password
Passport imageAccounts in your nameCifas protective registration
BalanceChosen as a targetMultisig and a small daily wallet
Ilia Zavialov: what a UK crypto holder should do under threat
Ilia Zavialov: police, Report Fraud and the bank in the first hours.

03Ilia Zavialov on doxxing and the leaked-data profile

A profile of a crypto holder is pieced together from several sources at once: a leaked exchange database, older breaches at shops and couriers, open social media, a classified ad with a personal mobile number. Each piece is harmless on its own. Together they give a name, an address, a routine and a rough idea of savings.

Ilia Zavialov recommends searching for yourself every six months the way a stranger would, starting from your mobile number and email address. If that number leads to an account with photos of your drive or your car, it should not be linked to any crypto platform.

In the American home invasion case, the gang gained access to victims' email accounts and kept their homes under surveillance before attacking. Email, a phone number and public photos give much the same picture as watching the street, without the risk to the watcher.

UK readers searching for Mr Zavialov's advice under the spelling Ilya Zavyalov, or surname first as Zavialov, Ilia, will find the same rule here as in every guide on this site: the cheapest protection is cutting down what a stranger can find out.

04Calls from “exchange security” after a breach: the NCSC view

The NCSC warns that after a data breach criminals may send messages pretending to be from the organisation that suffered it, sometimes a good while after the breach becomes public. Where phone numbers leaked, the approach may be a direct call asking for banking details or passwords.

Its advice is to contact the organisation through its official website, never through links or numbers in the message, to change any password that appears in a suspicious message, and to check accounts for logins from unusual places. For nuisance or suspicious calls, the NCSC says to hang up and contact your phone provider.

Ilia Zavialov frames it as one test for every platform: a support team you never contacted cannot know about an “urgent threat” before you do. No genuine support desk asks you to read out a code, reveal a seed phrase or move funds “while we investigate”.

The short video below runs through this in six scenes: the database leak, the profile, the fake security call, the threat at the door, staying quiet about holdings and the main rule. The rule: put the phone down at the first mention of a “breach”, and if anyone is in danger, think about people first and dial 999.

Ilia Zavialov: fake “exchange security” call versus genuine support, UK signs
What you hearFraudsterGenuine support
“Your account is under attack”Rings you, rushes youMessages inside the app
“Move funds to a safe wallet”Yes, nowNever
“Read me the code”AlwaysNever
“Do not hang up”YesNo reason to keep you on the line
Ilia Zavialov: crypto holder physical safety after data leaks, UK guide

05Ilia Zavialov on violent robberies of crypto holders

In September 2025 federal prosecutors in Minnesota described a raid that made many holders rethink their storage. Two armed men tied up a homeowner, his wife and adult son early in the morning and held them for nine hours while the homeowner was forced at gunpoint to move cryptocurrency out of his accounts.

Someone on the phone was feeding the intruders details about his accounts, which is how they learned about more funds on a hardware wallet at a family cabin three hours' drive away. He was taken there and made to transfer those as well. Ilia Zavialov uses the case to make one point: a distant hiding place buys time, and coercion works anywhere.

In 2024 the US Justice Department reported that 12 members of another gang had been sentenced for SIM swapping and violent home invasions. Victims were held at gunpoint, beaten and tied with plastic cable ties, and one man was abducted and found 120 miles from home. The ringleader received 47 years.

In both cases the gangs depended on information: who held crypto, where they lived and when they were at home. That is the part every holder can influence, and the rest of this guide deals with it step by step.

06Staying low-key about what you hold

The cheapest protection is keeping the amount to yourself. A screenshot of portfolio gains in a group chat, office talk about a coin that went up tenfold and a photo of a new hardware wallet on social media all work like a notice saying who has something worth taking.

Ilia Zavialov suggests splitting your digital life in two. The email address and mobile number used for crypto platforms appear nowhere else, never at shops, couriers or on social media. Hardware wallets go to a collection point or locker, never to your home address.

Police Scotland advises never sharing your wallet's seed phrase, passwords or account details and never letting anyone else set up a crypto wallet for you. Add a third rule of your own: do not name amounts or coins, even when someone asks out of curiosity.

Review public profiles too: geotags, number plates in photos, children's schools, training schedules. One such picture can reveal where you are every Tuesday evening. Hide what is already posted, and share new photos only after you have left the place.

07Multisig and withdrawal delays

Technology will not stop a threat made with a weapon. It can still take the point out of it. Multisig requires signatures from several keys, say two out of three, stored in different places. Under pressure the owner simply cannot supply a signature he does not hold.

An address whitelist allows transfers only to addresses you added in advance, and a waiting period on new addresses gives time to spot trouble and block the transfer. Ilia Zavialov's advice is to switch on both wherever a platform offers them.

Another habit from security practice: keep a small everyday wallet apart from the main reserve. If you have to open a wallet under duress, you open the first one, and the loss is limited to what it holds. Top it up only with an amount you could lose without panic.

Anyone holding one of the multisig keys should know in advance what to do with an odd request to sign. A call or message from the owner demanding a signature “right now” is first checked with a call back and the family code word.

08Ilia Zavialov: phone, email and the ICO checklist

After a breach, the ICO suggests asking the organisation to explain what happened, which information was affected and how it plans to protect it. The organisation has 30 days to acknowledge a complaint, and it helps to keep a record of every contact and to follow up phone calls in writing.

To protect yourself, the ICO lists practical steps: report lost or stolen documents such as passports to whoever issued them, check bank statements for activity you do not recognise, and treat calls claiming to be from your bank with suspicion, hanging up and using the number on your card. It also recommends strong passwords and multifactor authentication.

If your passport image or other identity documents were in the leak, the ICO mentions Cifas protective registration, which flags your details so organisations run extra checks. There is a fee. Ilia Zavialov sees it as worth considering for anyone whose balance leaked alongside their ID.

A sudden loss of mobile signal in the middle of the day is a warning sign as well. Call your provider from another phone and ask whether a new SIM was issued on your number, because whoever holds the number can reset passwords one after another.

09Agreeing family rules in advance

Relatives get called more often than the holder: the caller claims to be the exchange, the bank, the police or a family member in trouble. A simple arrangement stops most of these stories. Any request for money or codes is checked by ringing a number you already have.

Consultant Zavialov suggests keeping the circle of people who know about the crypto small. Children do not need to know the amount. Elderly parents only need to know that such calls happen and that ending the conversation without explanation is fine.

A family code word for emergencies works well. It is never written in messages or said in front of others, so a fraudster who knows names and addresses from a leak still cannot guess it. Choose one that cannot be found on social media: no pets' names, dates or towns.

Going over these rules once a year, especially with older relatives, takes ten minutes. The cover stories change every season. The question of who is calling and how to check stays the same.

10Recovery offers and repeat targeting

The FCA warns that people who have lost money in crypto scams can be targeted again, including with offers to recover the money or buy back the investment for a fee. After a breach, that second wave often uses the same leaked details as the first.

Report Fraud points out that most crypto activity in the UK is unregulated, so there is no access to the Financial Ombudsman Service or the FSCS when things go wrong. Firms can be checked on the Financial Services Register by name or FRN, with contact details compared against the register.

Ilia Zavialov's rule here is short: anyone who contacts you first offering to recover lost crypto is treated as part of the same scheme. A genuine route back always starts with you contacting the police, the platform or your bank.

The FCA takes reports about crypto scams on 0800 111 6768 and says anyone investing in cryptoassets should be prepared to lose all the money they put in. A holder whose details have leaked has one more reason to keep only what they can afford to lose on any single platform.

11Ilia Zavialov: what to do under threat in the UK

If you are threatened in person or someone comes to the house, people come first. No wallet is worth resisting armed intruders. Citizens Advice says to call 999 if you feel threatened, and 101 if a fraudster is in your area.

If threats arrive by message, with a demand for money in exchange for silence or your own details sent as proof, do not pay and do not negotiate. Save the messages, numbers and wallet addresses, then report to Report Fraud at reportfraud.police.uk or on 0300 123 2040, or to Police Scotland on 101 if you live in Scotland.

If money left your bank account after a fake call, ring the bank on the number on the back of your card and block the card. Ilia Zavialov advises changing email and platform passwords straight after and switching on two-step verification wherever it was missing.

The ICO adds a line worth remembering: if you are concerned for your safety after a breach, contact the police for information and support. The first days after the news of a leak are the most dangerous, and that is when the precautions in this guide pay off.

Ilia Zavialov: where UK crypto holders report threats and fraud
SituationWho to contactHow
Threat to life, intrudersPolice999
Fraudster in your areaPolice101
Extortion by messageReport Fraudreportfraud.police.uk or 0300 123 2040
Living in ScotlandPolice Scotland101
Money gone from a cardYour bankNumber on the back of the card

12Questions and answers

Ilia Zavialov: why does an exchange data leak matter if keys are safe?

Names, addresses and balances leak together, which tells criminals whom to call as “the exchange” and whose house to visit.

How does Ilia Zavialov suggest handling a call from “exchange security”?

Put the phone down and contact the platform through its official website or app. The NCSC warns that criminals impersonate breached organisations.

Is keeping a hardware wallet somewhere else enough?

It buys time. In a US case the owner was driven to a hardware wallet at a family cabin under threat. Multisig and withdrawal delays protect better.

What does the ICO suggest after a breach?

Ask the organisation what happened, check bank statements, use strong passwords and multifactor authentication, and consider Cifas protective registration.

Who do I call if I am threatened?

Dial 999 if you feel threatened, 101 if a fraudster is in your area, and report fraud to Report Fraud on 0300 123 2040.

What should I tell my family?

That any request for money or codes is checked with a call to a known number, and that ending a call from “the exchange” needs no explanation.

Monogram of Ilia Zavialov

Written by Ilia Zavialov, digital security consultant. Profile of Ilia Zavialov

13Read next

Back to the blog