Mere loss of control counts: German court puts crypto breach payouts near €100

Crypto's breach season just got a legal playbook. At the end of October, two crypto industry players — swap service Wagyu and blockchain analytics firm Chainalysis — confirmed that outsiders had gotten into their data. For customers in Germany, that switches on two GDPR rights: finding out exactly what's stored about you, and claiming compensation for it.

Wagyu is the swap service where you never make an account — you fire coins to a deposit address and get others back. Security firm Hudson Rock's analysis, reported by Forklog on October 29, puts the exposed set at 38,628 order records and 10,139 unique IP addresses, spanning July 18 to October 26, 2026. In 4,580 completed Monero orders, the deposit transaction, the receiving address and the IP address sit in the same record. The team confirmed the breach and said customer funds were untouched.

Chainalysis sits a rung higher up. In its own security notice on October 30, the analytics firm said an attacker reached user IDs, full names, email addresses and job titles — but only for people at customer companies who work with its software. Investigation material, passwords and session keys stayed out of reach, according to the company. Retail investors are largely absent from that set; the risk is indirect, with real compliance-department names turned into convincing phishing bait.

Germany's Federal Court of Justice already put a number on the damage. In a November 18, 2024 ruling on the 2021 Facebook scraping, which exposed data from around 533 million users, the court rejected the Cologne higher regional court's view that loss of control isn't damage at all. The BGH held that even a mere and brief loss of control is non-material damage, and it saw no legal objection to roughly €100 for that. No proof of actual misuse, no visible consequences required.

Before claiming anything, find out what you're claiming over. Article 15 GDPR hands you a free copy of the data a provider holds on you, along with processing purposes, recipients, planned retention and where the data came from. Under Article 12(3), providers must answer within a month, extendable by two months for complex requests — but they have to explain why inside the first month. Send it by a traceable route, note the date, and keep the reply: it becomes your key evidence later.

More than €100 takes more than lost control. Article 82(1) lets anyone with material or non-material damage claim against the controller — the company deciding how your data gets used — and the European Court of Justice ruled in December 2023, in case C-340/21, that a well-founded fear of future misuse can itself count, while the provider must show its security measures were adequate. The only escape hatch is Article 82(3), and it requires the provider to prove it bears no responsibility whatsoever. Stolen coins are material damage at full value, though you'd have to show the theft flowed from the breach rather than your own custody slip. The BGH also let victims secure a declaration that the provider answers for future damage — which matters when phishing lands months down the line.