Privy August 2026 incident: emails were taken, crypto wallets were not

On August 6, 2026, Privy’s security team was told that Metabase — a tool they used for usage reports and customer support — had been broken into. They finished a first investigation that same day and began notifying the companies that use Privy. They published their own account of what happened on August 10, 2026.

The attacker obtained email addresses of Privy customers and of people who use apps built on Privy, along with a small set of extra fields that app developers had chosen to store. Privy says those fields were not tied to any one customer and has not said what they contained. Wallet systems and login systems were not reached; Privy says those run separately. No number of affected people or companies has been published.

Your wallet was not emptied. That is not the same as “this missed you.”

If you have seen this story at all, you have probably seen the line that wallets and logins were untouched. That line is true. The attacker was inside a reporting tool, not inside the systems that hold crypto or handle sign-in. Nobody used this break-in to reach a wallet from the inside.

Here is what that framing leaves sitting in your lap. The attacker now has inboxes belonging to companies that use Privy and to people who use those companies’ apps. Privy is the behind-the-scenes wallet and sign-in layer for crypto products. You may never have typed the word Privy and still have been in that tool, because you used an app that sits on top of it. This is not a random marketing list. It is a list of emails the sender can treat as belonging to people who use crypto apps.

That is useful for a different kind of theft: a message that looks like it comes from an app you already trust, asking you to restore a wallet, confirm a login, or “secure” an account. Privy itself said the incident may increase the risk of phishing, targeted messages meant to trick you, or other unsolicited contact. The reassuring sentence and the dangerous sentence are both true at once. This was also not someone logging into your email. It was someone copying a list of addresses out of a company’s internal tool.

There is another gap. Privy notified its customers — the apps — and later sent each of them findings for their own application. It has not published a count. If you are an ordinary user, a notice may never reach you. Silence is not proof your address was left out, and a clean result from an online “have I been breached?” search is not proof either. This kind of copy rarely shows up in those searches.

What to actually expect

• Unexpected emails about a wallet, a login, or an app you use, especially ones that ask you to click, restore, or verify. Privy has already flagged that risk because emails were taken.
• A note from an app you already use, if that company received Privy’s findings and chose to tell its users. Read it. Do not treat a second, lookalike email with a link as the same thing.
• No public headcount, and no reliable way to look yourself up in this incident. Not hearing from Privy does not mean your address was absent.
• No coins moving on their own because of this break-in, if Privy’s description is right. If funds later disappear after a rushed click, that is a follow-on trick — not the original intrusion emptying a wallet.

What you can and cannot fix

If your email address was sitting in that Metabase tool, it is out. It cannot be pulled back. The extra developer-stored fields are out too. No one can delete the attacker’s copy, and no service can honestly promise to remove the breach.

• Treat surprise crypto and app emails as hostile. Do not click, reply, or “verify” from the message. If you need to check an account, open the app the way you always have — not from a link you were sent.
• Do not try to un-leak the email. Paying a fixer or submitting the address to a removal company will not get that copy back.
• Shrink the public trail that makes a bare email dangerous. A leaked address becomes much more useful when it can be joined to people-search listings that add relatives, phone numbers, employers, and previous addresses. Those listings, unlike the stolen Metabase data, can actually be taken down. That is the lever that still exists.
• Listen only through the channel you already know. If an app you use posted guidance inside the app after this incident, follow that. Ignore parallel emails, texts, or DMs that arrive with urgency and a link.