Binance KYC Data Leak - Allegedly

[Baofeng]

There have been rounds of personal data that supposedly a hacker have penetrated Binance again and the criminals is demanding a sum of 300 BTC as ransom.

https://www.binance.com/en/blog/365766157488967680/Statement-on-False-KYC-Leak

So I'm sure majority of us here are Binance users, so just be careful if you received e-mails stating that they're are from Binance and wanted your personal data, blah blah blah, used your common sense and don't fall for this trick.



https://twitter.com/cz_binance/status/1158978929803182080

[AB de Royse777]

Yeah seen this and kinda bad news. I also read that the guy is asking for 300BTC from Binance. This is blackmailing. On the other hand Binance announced a reward of 25 BTC I think, if anyone help them to find the person.

This news after waking up in the morning was not pleasant for me.

[NeuroticFish]

I've read somewhere today that it may be data from an older hack/leak, possibly one year old...

[DdmrDdmr]

Binance is pointing to it being old data, possibly related to a KYC clearance company they hired back in 2018. I’ve seen a few of the alleged photos, and they show people holding their passport and a February 2018 dated handwritten notice with the term “Binance” and the date.

Interestingly enough, they are offering a bounty for information (call to bounty hunters here):

If you are able to provide any information to help identify this person and allow us to pursue the individual through legal action, we will offer a reward of up to 25 BTC, dependent on the relevance of the data supplied. You may submit this information by opening a support ticket at https://support.binance.com.

source: https://www.binance.com/en/blog/365766157488967680/Statement-on-False-KYC-Leak

[rdbase]

So if binance can get hacked being the biggest exchange out there with top notch security.
What says the new exchange blockchain.info will be putting out called the pit wont suffer the same fate in the future?
https://www.coindesk.com/bitcoins-largest-wallet-blockchain-just-launched-its-first-crypto-exchange
Now kind of worried about submitting kyc to any of these exchanges if binance can be hacked and have so many customer identifications floating out in the ether.

[Upgrade00]

...

That's why I regularly advise people to never get to comfortable, especially when dealing with financial establishments.
This affects traders and hodlers alike, if you're going to patiently hodl your bitcoins (or some other currency) always keep tabs with your investments. Pick the most secure option for storage and stay updated on any news or changes.

The issue of user privacy is one we would be having for a long time to come, as long as it's put out there, it can be hacked. It's best to comply with KYC only when absolutely necessary.

[o_e_l_e_o]

So if binance can get hacked being the biggest exchange out there with top notch security.

How do we know they have "top notch security"? Has there been any independent audits of their security practices? Have any external experts reviewed their security set up? We only have Binance's own word to go on, and they are hardly going to come out and say "Hey guys, out security is pretty questionable, but it's not our KYC documents so we don't care."

source: https://www.binance.com/en/blog/365766157488967680/Statement-on-False-KYC-Leak

This is some mental gymnastic nonsense. They say they haven't been hacked because the images don't contain their watermark. Then in the next paragraph, they say the images came from a time when they were using a third party to process KYC, which wouldn't be applying Binance's watermark in the first place. They call the leak "fake", but then offer 25 BTC for any information regarding it. It sounds like they don't really know what's going on. There are, however, some suggestions floating around that these documents may all have come from a Binance phishing site, which told users their account was locked until they uploaded KYC documents.

If you have ever completed KYC on Binance, then you should consider doing the following as a minimum:

Place a fraud alert on your credit report. This is free to do. This will flag up to any third party which is approached for a loan or credit in your name, and should prompt them to contact you before extending said loan or credit.
Keep a close eye on your credit report. Anything which shows up there which you didn't initiate yourself is a major cause for concern. Dispute these with the bank or lender involved as well as with the credit agency.
Keep a close eye for suspicious activity on any of your accounts, such as attempted password resets or address changes.

[bitmover]

At least now I have some advantages of being poor: 2 BTC withdrawal limits is far beyond my possibilities for trading, so I didn't need to do any KYC in binance lol

[olric]

use @HydroBlockchain for 2fa

[jackg]

I don't think they've hacked email addresses from binance because none of my addresses have emails (checked spam, junk and everything)...

I doubt much will come from this, it'll be like the alledged coinbase hack where they just sent a load of kyc documents they'd bought off the internet and said they got it from coinbase.



One of the reasons why we shouldn't have KYC in this sector, no one - even governments - are able to properly store it.

[Lauren Smith]

Yet one more reason from a never-ending list of why to never give out KYC. It has nothing to do with crime and money laundry. It does much more damage than good. The thing is the damage is directed at us which is bs.
KYC doesn't protect us, it puts us at even more risk to criminals. KYC is supposed to stop crime yet all I see is an excuse for the greedy government to make claims on our trades. KYC is only for government profit. I promise you they don't care about our safety. I also doubt serious money laundry happens on exchanges. If I were a criminal I would rather run my finds through fake companies and fronts. I think a dump on the exchange is too risky to be quite honest. These people don't even tell us how money laundry is done or if it even is done at all. It is just an excuse.

Saying "I have nothing to hide because I am doing nothing wrong" is the same as saying "I don't believe in the protection of free speech because I have nothing to say"

If this is true can you just imagine what manner of hell could be unleashed if this leak happens?

[Velkro]

This news after waking up in the morning was not pleasant for me.

This will happen all the time. Bitcoin exchanges are #1 targets for hackers from all over the world.
Its very dangerous business with a lot of risk to company and customers.

[vladimirhf]

I don't think they've hacked email addresses from binance because none of my addresses have emails (checked spam, junk and everything)...

I doubt much will come from this, it'll be like the alledged coinbase hack where they just sent a load of kyc documents they'd bought off the internet and said they got it from coinbase.



One of the reasons why we shouldn't have KYC in this sector, no one - even governments - are able to properly store it.

all them (exchanges, icos) need better methods, maybe store offline after they receive it. or integrate 3rd party services like civic.

[Reeny560]

This is a clear reason of why am not in support of exposing LYC details.  Of course, KYC has its own advantage in terms of money laundering but its disadvantage outweighs the advantage. Most of these leaked KYC documents are being sold on the black market sites which put customers to more criminal risk. Kyc are meant to protect its users and of any company can not guarantee the safety of its users data then there is no need of requesting for the KYC documents

[DdmrDdmr]

In March 2019, Binance announced a partnership with IdentyMind (see https://www.binance.com/en/blog/317231329092952064/Binance-Partners-with-IdentityMind-to-Enhance-Compliance-and-Data-Security-Measures), being one of the goals to step-up compliance for AML and KYC. It does not reference exactly how the flow of data for KYC is spread between Binance and IdentityMind, and reading through Binance’s terms and privacy there is no reference to how KYC data is managed and stored, even now.

I wonder what the outcome would be of a requirement to reveal what personal data they store there, where and how …

[Polar91]

Luckily, Binance allows users to trade and withdraw funds for non KYC verified users but has a limitation amount. This news makes me more worried in doing KYC in different exchanges. If there's a security breach in the number 1 exchange, then it's not impossible to happen in other exchanges. This should be a lesson for everyone to be more careful in giving information online.

[tbct_mt2]

At least now I have some advantages of being poor: 2 BTC withdrawal limits is far beyond my possibilities for trading, so I didn't need to do any KYC in binance lol

Agreed! It is a gift that Binance gives crypto enthusiasts.
People don't need to be poor to do this. Storing huge money on exchanges is always bad idea. If someone have 10 BTC, what sent to Binance to take profits, at $12,000, for instance, then they can easily to withdraw their money at up to 2 BTC per day. So, in total, it takes five days in a row to withdraw all 10 BTC. I think it is fine, and there is no need to do KYCs on Binance.

[Baofeng]

Just to give everyone a heads-up,

Investigation Update

The latest evidence of this investigation indicates that some of the leaked images overlap with images that were processed by a third-party vendor, which Binance contracted a few times between early December 2017 and late February 2018.

During our review of the leaked images, there were multiple photoshopped or otherwise altered images which do not match the KYC images in our database and are being accounted into the comprehensive investigation. In addition, every image processed through Binance for KYC purposes is embedded with a concealed digital watermark, which was notably absent from all of the leaked images.

VIP treatment for those affected? 

We are compensating affected users with a lifetime Binance VIP membership, including preferential trading fees, support, and more services. We encourage users to contact us with questions and about restitution by submitting a request on the Binance Customer Support Center under “Security Issue.” Please make sure to verify you are being contacted via official Binance email communication.

https://www.binance.com/en/blog/371631019142385664/Update--Action-Response-ThirdParty-Vendor-KYC-Matter

[AdolfinWolf]

VIP treatment for those affected? 

We are compensating affected users with a lifetime Binance VIP membership, including preferential trading fees, support, and more services. We encourage users to contact us with questions and about restitution by submitting a request on the Binance Customer Support Center under “Security Issue.” Please make sure to verify you are being contacted via official Binance email communication.

https://www.binance.com/en/blog/371631019142385664/Update--Action-Response-ThirdParty-Vendor-KYC-Matter

That's kind of funny.

"Hey we leaked your personal data including your face, SSN, and or other fingerprints, sorry about that, but hey, why don't you come back to our platform and we'll give you a DISCOUNT on the fees you pay US if you use our platform again."

dude's nuts.

I'd probably think about taking them to court if i had found they were so negligent with my data, but where the hell are they even based.. I have a feeling that if you're a victim of this, there's not much you can do.

[squatter]

VIP treatment for those affected? 

We are compensating affected users with a lifetime Binance VIP membership, including preferential trading fees, support, and more services. We encourage users to contact us with questions and about restitution by submitting a request on the Binance Customer Support Center under “Security Issue.” Please make sure to verify you are being contacted via official Binance email communication.

https://www.binance.com/en/blog/371631019142385664/Update--Action-Response-ThirdParty-Vendor-KYC-Matter

That's kind of funny.

"Hey we leaked your personal data including your face, SSN, and or other fingerprints, sorry about that, but hey, why don't you come back to our platform and we'll give you a DISCOUNT on the fees you pay US if you use our platform again."

dude's nuts.

I'd probably think about taking them to court if i had found they were so negligent with my data, but where the hell are they even based.. I have a feeling that if you're a victim of this, there's not much you can do.

Sadly, it's the norm. Poloniex badly screwed up by exposing margin lenders to extremely thin markets, which resulted in lenders losing 1,800 BTC. What did they do? They offered victims "reimbursement" via trading fee discounts.

I suppose this is the price we pay for using exchanges registered in Malta, Bermuda, Seychelles, etc. and operated from who knows where. There's zero accountability.