A KYC database sold on the Darkweb ?

[kenzawak]

Hacked Customer Data From World Leading Cryptocurrency Exchanges For Sale On The Dark Web?

https://www.ccn.com/hacked-customer-data-from-world-leading-cryptocurrency-exchanges-for-sale-on-the-dark-web/

"On a darknet market called “Dread,” a vendor going by “ExploitDOT” is attempting to sell user data from the know-your-customer (KYC) data top cryptocurrency exchanges ask for, required by most jurisdictions.

According to data shared with CCN, the hacker has an ad that has been online since July 2018, in which he claims to have hacked documents used in KYC checks – including identity cards and drivers’ licenses – from users of top exchanges like Bittrex, Poloniex, Bitfinex, and Binance.

The data is seemingly for sale for $10 per 100 documents or more, with discounts applying for those who buy in bulk, all the way up to $1 per 1,000 for an order of over 25,000. CCN was able to independently verify the ad on the dark web, which is still online. No links to it will be added to avoid promoting the service."



A few days ago, this also made news :

https://www.techspot.com/news/78317-leaked-database-exposes-87gb-emails-passwords.html

[cokroalif]

it's something scary, now KYC can also be hacked, I really don't think the darkweb site is really dangerous

[coolcoinz]

That's the weakness of KYC and we had a taste of it when facebook got hacked and another one when this forum's database got stolen. I miss the times when we could trade freely without having to deal with KYC on sites like bittrex and poloniex, but things change. Unfortunately, in most cases they change for the worse.
I used to be and still am against KYC and government agencies trying to oversee crypto trading, but reading the posts of some forum members here makes me thing that I'm in the minority. 

[OmegaStarScream]

Just one of the many reasons why I don't do KYC verifications. I don't expect people to learn anything from this though because It seem like people don't care about their privacy as long as they don't have to put extra efforts to use the forums or P2P platfroms to trade instead.

[itarachiu]

That's the weakness of KYC and we had a taste of it when facebook got hacked and another one when this forum's database got stolen. I miss the times when we could trade freely without having to deal with KYC on sites like bittrex and poloniex, but things change. Unfortunately, in most cases they change for the worse.
I used to be and still am against KYC and government agencies trying to oversee crypto trading, but reading the posts of some forum members here makes me thing that I'm in the minority.  

VPN + download Google Auth for PC = No more KYC  
I tried as a test 1 year ago and I successfully bypass all KYC verifications, I forgot on which one of exchanges... it was one of the most popular.

[Upgate]

I have always had my skepticism on the security of one's personal data information when undergoing know your customer the internet is no longer safe and hackers are on the move if there can be another means of proving identity it would really save this menace

[aoluain]

This is a lesson for us all.
As soon as we part with our personal information on the web we are
trusting lthers to put sufficient security measures in place to mind it
for us. If those security measures are not good enough there is nothing
we can do, its too late.

[wizardcrypto]

This is another big challenge in the crypto space that need urgent attention. If nothing is this will scared many newbie and institutional investors away from the crypto industry. Many of the kyc that is been use now are from fail ico project.after returning funds to ico investors they use the kyc for criminal activities that even pay them more than the ico project since they know many people don't participate in ico any more.regulation of ico will solve this issue

[squatter]

Just one of the many reasons why I don't do KYC verifications. I don't expect people to learn anything from this though because It seem like people don't care about their privacy as long as they don't have to put extra efforts to use the forums or P2P platfroms to trade instead.

I'm of a similar mindset. I did do KYC at one exchange -- Coinbase. That's because sometimes I need to buy or liquidate fast, for amounts larger than I'm comfortable with doing P2P, especially considering the fraud risks. I think they're one of the most likely to properly comply with data protection laws. I definitely wouldn't multiply my identity theft risk by doing KYC anywhere else, though.

[Teamfearless]

this really scary but i can tell there no credential with the vendor .. its also a other way to scam other who wanted  people information .. when i contact them for credit card information .. they will take your money and give you fake info ...  if they have binanace info they will rather login people account to steal their asset rather than selling information to people ...  so i will call this scam !!!  

[bL4nkcode]

VPN + download Google Auth for PC = No more KYC  
I tried as a test 1 year ago and I successfully bypass all KYC verifications, I forgot on which one of exchanges... it was one of the most popular.

What kind of KYC procedure does that service/site have if it only needs google auth and VPN.

That's why KYC is bullsh*t from projects who want to run their ICO. ICO and mostly the scam once required KYC, then sold it to some people who needs personal info since data == money. I only do KYC to services I needed the most and a reputed service especially to convert crypto to fiat, but taking kyc to ICO or bounties or any shady exchange? Thanks but no thanks.

And this reddit user/hacker trying to sell them at very cheap price means that more people will get access of that info and possible, it will be leaked even in google. And after several time, this people who doesn't care their privacy will see their names used to scam someone in the internet because of identity theft.

[ribowo76]

This should be a concern for exchange managers. A big mistake, until something like that happened. Do not let it happen again in the future, because it will reduce public trust. Even more so, it can help people rethink to enter the world of crypto

[cizatext]

This is serious and a very big challenge for the security of customers account and identity, those big exchange should be careful and customers who pass through they kyc process should watch out cause they data is now open for sale and any one can get across to you information.

[Mpamaegbu]

Just one of the many reasons why I don't do KYC verifications. I don't expect people to learn anything from this though because It seem like people don't care about their privacy as long as they don't have to put extra efforts to use the forums or P2P platfroms to trade instead.

I have often expressed this concern with bounty and signature campaign managers who expose the email addresses of their participants too. At a time I had to take it up seriously with one of the top managers here before he then had to hide that column. Sometimes, we are helpless in a situation like that. Imagine bounty managers even introducing KYC to an ongoing bounty midway into the project. We often see this with bounties managed by inexperienced managers, anyway.

[Coyster]

User data should be treated with utmost importance and should be highly improbable to give away in such manner,i blame most of this exchanges and projects which treat such information with laxity and pay less attention to user identity and anonymity.
Most times I begin to feel this entire KYC process could be of more harm than good to the entire community

[kenzawak]

this really scary but i can tell there no credential with the vendor .. its also a other way to scam other who wanted  people information .. when i contact them for credit card information .. they will take your money and give you fake info ...  if they have binanace info they will rather login people account to steal their asset rather than selling information to people ...  so i will call this scam !!!  

It's a possibility yes.
There is no confirmation that this database actually exists. Some exchanges like Binance or Poloniex are mentioned so if this is all true, we have much bigger concerns here, like losing our funds.

[Romeoetin]

Wow. This is why I am always skeptical when performing this KYC thing. Imagine the number of identity theft and fraud that might be performed using unsuspecting victims data.. Please what can be done to curb this menace?

[pixie85]

User data should be treated with utmost importance and should be highly improbable to give away in such manner,i blame most of this exchanges and projects which treat such information with laxity and pay less attention to user identity and anonymity.
Most times I begin to feel this entire KYC process could be of more harm than good to the entire community

Everything can be stolen. The best way to prevent data leaks is to use user data for verification and destroy it right after. This means that you will hold the user's name and email, but the rest like ID scans, photos, addresses and other information will never be stolen.

I'd prefer if there was no KYC at all. When you're buying food in a store nobody wants your name but to exchange some cryptocurrencies you need to show your ID. It's stupid!

[eternalgloom]

And this is exactly the reason why I refuse to use any exchange that forces me to upload personal identification documents.
I've mentioned this many times in previous posts, but most people just don't seem to care.

In a way I'm kinda glad that this happened, just because now I can actually prove my point the next time this comes up.

I only buy Bitcoin through a Dutch exchange that works with IBAN (Bitonic), they only do SMS verification and your account is verified by purchasing Bitcoin via IBAN transfer.
I have a burner sim card, so that isn't a problem for me. I also don't mind using IBAN, since the transfers are secure.

To all people who just send their passports and pictures to exchanges without thinking about it:
Have fun dealing with identity theft in the future!

[hatshepsut93]

Just because someone says that they have a stolen database, doesn't mean that it's true, quite often scammers are selling fake databases, you could probably find thousands of offers like that on darknet markets.

But you are right, because this scenario is possible, KYC should be avoided as much as possible. Exchanges are going to take a huge hit when atomic swaps will become more common.