TrueCoin Third-Party Vendor Breach: TUSD User Data at Risk

TrueCoin’s internal systems were not compromised or accessed, and the company affirmed that the attack was limited to a single vendor.

After one of TrueCoin’s third-party vendors was compromised, the team behind the stablecoin TrueUSD (TUSD) announced a potential disclosure of certain Know Your Customer (KYC) and transaction history information.

Until July 13, 2023, TrueCoin was the operator of the TUSD stablecoin. The security team of a third-party vendor informed TrueCoin on October 16 of “an anomalous account change within [TrueCoin’s] organization made by a compromised support vendor.” TrueCoin, therefore, suspects that some of TUSD’s extant customer data has been compromised.

TUSD team was informed by TrueCoin that they received a third-party vendor's notification that the vendor’s Security Team detected “an anomalous account change within [TrueCoin’s] organization made by a compromised support vendor.”

— TrueUSD (@tusdio) October 16, 2023

TrueCoin’s internal systems were not compromised or accessed, as the intrusion was limited to a third-party vendor. “TUSD system is SECURE and not attacked. Both TUSD system and TUSD’s reserves are UNAFFECTED,”

Names, email addresses, and phone numbers, among other information obtained from such intrusions, are typically used in phishing attacks. Attackers target unwary investors by imitating various crypto services, frequently promising high returns in a brief period.

The impact of the attack and the resulting data breach has yet to be determined, as the total number of users whose information was compromised was not disclosed during the announcement.

TrueCoin recently severed ties with Prime Trust, a Nevada-based exchange, after the latter unexpectedly ceased fiat and cryptocurrency deposits and withdrawals.

TrueUSD announced that “it is not affected by the situation” at Prime Trust, highlighting its diverse partnerships and commitment to sustaining “multiple USD rails” elsewhere. TrueUSD stated that: