Bitcoin Forum

Hacked Customer Data From World Leading Cryptocurrency Exchanges For Sale On The Dark Web

On a darknet market called “Dread,” a vendor going by “ExploitDOT” is attempting to sell user data from the know-your-customer (KYC) data top cryptocurrency exchanges ask for, required by most jurisdictions.

According to data shared with CCN, the hacker has an ad that has been online since July 2018, in which he claims to have hacked documents used in KYC checks – including identity cards and drivers’ licenses – from users of top exchanges like Bittrex, Poloniex, Bitfinex, and Binance.

The data is seemingly for sale for $10 per 100 documents or more, with discounts applying for those who buy in bulk, all the way up to $1 per 1,000 for an order of over 25,000. CCN was able to independently verify the ad on the dark web, which is still online. No links to it will be added to avoid promoting the service.

https://www.ccn.com/wp-content/uploads/2019/01/exchanges-kyc-sale.png

A cybersecurity expert who contacted CCN and chose to remain anonymous has detailed that after contacting the individual posing as a buyer, he was able to get three free samples out of him as proof that the leaked documents are legitimate.

As proof, the cybersecurity expert got pictures of individuals holding up a piece of paper with the word “Binance” and the date the picture was taken at. In these pictures, their faces are visible, as well as their identity cards or drivers’ licenses.

CCN had access to these images, which appear to be legitimate. Although the sample was small, the vendor selling the hacked data claims it has documents from people in every country cryptocurrency exchanges serve.

An exchange the security expert allegedly had with Binance via email, which couldn’t be independently verified, seems to show the latter found “some inconsistencies” between the data it was presented with and the “samples provided” – presumably the KYC images.

The exchange’s spokesperson allegedly further noted they have their “theories in regards to how this information may have been obtained,” detailing that no signs of unauthorized access to their system had been found. CCN has reached out to Binance to clarify the situation but hasn’t heard back at the present time.

Binance is notably an exchange praised in the cryptocurrency community for its security practices. Recently, It foiled the plans of the Cryptopia hacker by freezing the stolen cryptocurrency, and last year thwarted a large-scale attack that saw Syscoin (SYS) surge on its platform.

Whether the leaked documents are connected to the recent ‘Collection #1’ 87 GB database leak, which includes over 700 million email addresses and 21 million passwords, isn’t clear.

Use an exchanges without KYC

This is why many people move to decentralize exchange, like IDEX, Etherdelta and so on. However, those exchanges are far behind the Centralized exchanges in term of features, UI/UX, and stability. There also some centralized exchanges that is not require KYC, but most of them don't provide any customer support, so it is more risky to put your money there.
I think the best option is register in a local exchange, that limit their user to certain nationality, so it is not too hard for handling user and the KYC data, so it is not easy to get hacked. 

10$ for 100 Document is too cheap for any exchange. If that document from KYC any exchange/market. Why they sell with cheap price? Why that exchange not steal more assets from their member? Why must their document?

Whether the leaked documents are connected to the recent ‘Collection #1’ 87 GB database leak, which includes over 700 million email addresses and 21 million passwords, isn’t clear.

That wasn't cheap if you sell all over 700 million email addresses, technically that will be $70 million, is that what you call cheap?
Yet, binance won't take any action to this hence their only serious concern is that no funds were stolen. That's it.

Horrible... In the past I went through KYC for at least a dozen crypto exchanges and now I am afraid of someone stealing my identity for criminal purposes. I am never again going through this process, but it looks like the damage has been done already.

Mostly everybody complied to KYC especially those local exchanges that forced their customers to avail a levelled up service by passing on our IDs.

I'm not sending mine again as well.

That is sort of black mail and we leave no choice than to comply to it or else we can't use their platform and the worst they will hold our funds.

Let just hope that our documents aren't there. lol!

Binance - SCAM. These scammers steals money

This is really bad. KYC on crypto stands against everything that crypto currency and decentralization stands for. Many people joined crypto because they thought they can have an anonymous transactions but KYC is now putting all that away