You data is not safe on centralized exchanges

[serjent05]

I don't trust unexpected text messages, especially with links. In any case, I visit the website to confirm if it is legitimate. It seems that hackers are behind this due to a data breach. Our identity is no longer safe in centralized exchanges once they are accessed by criminals. We know that KYC is a regulatory requirement in the financial industry designed to verify the identity of customers to prevent money laundering and fraud. However, when you do comply, your identity becomes vulnerable to risks, and the level of anonymity in transactions decreases. No matter how secure a platform may be, it's pointless if it's not responsible.

We should be cautious and do not click any link given to us without verifying the validity of the link.  Often times malware is loaded on that link ready to inject our device system once we clicked it.

KYC is useless because it doesn't actually prevent criminals from using centralized exchanges. Criminals can simply provide fake or stolen personal information during the KYC process. This means that KYC doesn't make centralized exchanges any safer for their customers.

They can fake the ID but the exchanges have a filter to prevent that, and that is having a selfie while holding the ID submitted and a bond of paper with a writing of the exchange domain, and date.  Though I agree that KYC does not make centralized exchanges any safer, it does verify if the person is really the owner of the ID submitted to the centralized exchange..

[1714797768]

1714797768

[1714797768]

1714797768

[1714797768]

1714797768

[Forever101]

This is a serious matter, that's why its very important to get some of this guys to this forum so that they can learn and get updated just as this matter is discussed now.  Information as such quickly get verified by experienced people on the forum and that help investors to be cautious as they read through people's post and comment regarding the issue.

Another means to get rid of this scam strategy is for centralized exchanges to always keep their users aware of such actions and how to avoid it.

[sokani]

Binance recently announced our partnership with Refinitiv, a know-your-customer (KYC) services provider company affiliated with Thomson Reuters. This partnership, through which Binance will utilize Refinitiv's automated KYC application on the world's leading cryptocurrency trading platform

According to this information, Binance has a KYC partner and the data breach could have come from Refinitiv or from Binance exchange. Where ever the breach might have come from, users still have a big role to play in safeguarding themselves. I want to believe not everyone who got the text message from the hacker fell for the click bait, so it's an issue of unawareness from the victims because this could have been avoided. It is still their responsibility to keep themselves well informed on cybersecurity and learn better ways to protect themselves.

[Alpha Marine]

This doesn't only happen with centralized exchanges, but all centralized institutions are liable to data breach.
There was a time this was a common way to scam people or their funds from their bank accounts in my country.
It's either people in the bank sell customers data to scammers or they're the scammers themselves.
It could also be that hackers have found a way in their system so they can get customers information.

You could open an account and within a week of opening the account you're receiving calls and emails from the said bank asking for login details and card details, only it is not the bank calling.
People are smarter these days to realize that it's a scam but people still fall for it a lot.

[serjent05]

As long as the information is saved in a cloud storage or can be accessed online, it will never be safe from hackers.  It does not include centralized exchanges but also other centralized online services.  Even the so called DeFi are constantly hacked.  So we should always think that there is no 100% security when it can be accessed online.

It is also possible that there is an under-the-table negotiation where centralized services hold data of people and offer them to newly established companies for prospecting.

[Peanutswar]

In my country even there's a implemented KYC with the Sim registration still their platform is not ideal to use because first the user can input a not real id for verification and still there's some messages came from different banks, casino and other platform that have event or seeking for assistance those are all ignored to my device. It's quite annoying but again there's no safe in the internet even though they agree with data privacy act still there's a chance our data might leak or they really sell it.

... now that the Philippines' health insurance corporation has been hacked and become a victim of ransomware, SMS and email of millions of people could have fallen victim to these attackers—a reservoir for bad actors to steal not only money but also PII (Personally Identifiable Information) that they can use to exploit.  

Somewhat similar story: https://www.philstar.com/headlines/2023/10/10/2302640/philhealth-hacked-what-we-know

Actually there's a lot of rumor here some people say it's an inside job so they can earn a money, some of them really tell that the Philhealth was hack and at the end of this point it's a government mistake because they didn't hire a cyber security and a good defender security too to their company. We know PH government didn't focus here too much.

[Ludmilla_rose1995]

How do hackers know who to send messages to?

There is only way to not worry about centralized exchanges, data breach, and privacy breaking. The solution is never do KYC or simply avoid centralized exchanges, don't use their service, it will give you rest of mind and happiness. In short, when you see this type of news, you will walk pass like you don't know anything about it because they have nothing on you. Simply see kyc as criminal activity that people indulge in and we know when you don't do crime, you will not have any fear even if they(hackers) try to stop you.

That's right, the best way to avoid misuse of personal data is not to carry out KYC, but there are many people out there who still depend on centralized exchanges because they have great liquidity and can provide members with the funds they need quickly, I carry out KYC at The big local exchange in my country, I don't have the option to avoid KYC because my local fiat pair is only available on exchanges that require KCY, if there was an option to avoid KCY then I would choose that.

[Darker45]

Physical robberies and attacks are much more worrisome but also much less common than online theft. Apparently, the bigger problem in the crypto space today is more of the latter than the former. And this is exacerbated by the widespread growth of centralized platforms which collect personal information from its users. Although this is also largely due to regulatory policies, these platforms aren't without responsibilities.

Actually, it's a simply thing. No data collection means no data breach. Data collection means there's data to be stolen. So, I guess crypto users will have to try their best to avoid platforms which demand personal data.

[_act_]

OP, thread's title is very misleading because "You data is not safe on centralized exchanges" has nothing to do with the given case. In article, we read that 11 users become a victim of phishing. It's their responsibility to check the url of where they enter the data. Centralized exchange is not an issue here. Even if these users ha self-custody wallets, they would still lose it because of their inattentivness.

Wrong. Go and read the news again, it is clearly stated in the news title.

If you want to argue with the news and if you you do not want to be wrong, come up with evidence that it is not through KYC submitted on the exchange by the exchange users that led to the hack. Becuase 11 people were victims does not mean they are the only one that got a phishing message. If it is only one person, I will not think it can be through KYC, but if it is getting to more people, we can think it may be caused by KYC. If you have a good answer to the OP question, that is it not KYC breach? Then give evidence that it is not.

Binance users in Hong Kong lose $450K in wave of fraud texts: HK police: https://cointelegraph.com/news/hong-kong-binance-users-phishing-scam-jpex-crypto-scandal

[pinggoki]

Is the message randomly sent to people? I think the hackers target Hong Kong Binance users and that can only be from data breach or insider work.

It's not randomly sent, there are hackers that scrape data on websites and there are people that are in-charge of getting data of large quantity of people and those people sell those data illegally to entities that are using those compromised data to do their nefarious deeds. These very things are the very reason why data are protected and why hackers sought them the most besides money and confidential files.

[Husires]

Everyone spies and collects your data, starting with browsers, Google, your service provider, Facebook and WhatsApp applications, Gmail, and even your phone or Windows operating system. Therefore, be careful when using your email if you do not want to find it filled with spam.
Centralized platforms do not protect customer data, and some of them share, store, or sell it to third parties, so you should mainly use centralized platforms that do not require identity verification when you have to.

[Hatchy]

So many people fell for this trick, especially the ones that were not educated , and they got all the funds in their account wiped out.

I think it will be ignorance that would make someone give out the digits of their debit card out to anyone. Even on registering a bank account, they will tell you strictly that the bank can never contact you, or text you privately for any personal documents. And if need be, they usually advice people to visit their local bank branch. When you come in contact with an unknown message or text requesting you provide details or click a link relating to your funds, it usually adviced to go to the original site and check if any such details are required at that time. Hackers are fond of these acts so someone who is socially active should be aware and alert just in case they come in contact.

[Wakate]

Everyone spies and collects your data, starting with browsers, Google, your service provider, Facebook and WhatsApp applications, Gmail, and even your phone or Windows operating system. Therefore, be careful when using your email if you do not want to find it filled with spam.
Centralized platforms do not protect customer data, and some of them share, store, or sell it to third parties, so you should mainly use centralized platforms that do not require identity verification when you have to.

It is true that our data might not be safe on centralized exchanges but there is nothing we could do about that because we ought to have account on a centralized exchanges for us to trade and stake our coins to earn more profits. Even the so called big investors for have accounts on centralized exchanges to make trades that might not be possible on decentralized ones. The most important things we need to ensure is to keep to good safety measures by not signing up on third party exchanges which could lead to spamming of our accounts or even for it to get compromised by hackers without our knowledge.

[icalical]

Is the message randomly sent to people?

I doubt that, On 2019, Binance reported that there are data breach on their user data, users email probably stolen and it could be sold online to scammers. This note exclusive to Binance or even crypto exchange, marketplace and other sites too. All the user could do is be more careful while receiving email that seems suspicious. And I think even those exchange knows that KYC is useless, but they still need to do that for formality to pass the government regulation and be considered as 'compliant exchange'

[Taskford]

How do hackers know who to send messages to?

Hong Kong police warned users of the scam in an Oct. 9 post to its Facebook page dubbed “CyberDefender.”

“Recently, fraudsters posing as Binance sent text messages claiming that users must click the link in the message to verify their identity details before a deadline, otherwise their account would be deactivated.”

Is the message randomly sent to people? I think the hackers target Hong Kong Binance users and that can only be from data breach or insider work.

According to the post, the phishing scheme has seen 11 Hong Kong-based Binance customers report combined losses of more than $446,000 (3.5 million Hong Kong dollars) in the last two weeks.

If it is someone like me, this is easily avoidable, but what if it gets to the hacker's selling peoples data to thieves and which can lead to physical robbery and attack.

https://cointelegraph.com/news/hong-kong-binance-users-phishing-scam-jpex-crypto-scandal


Why KYC is extremely dangerous – and useless

But what can we do with it? Binance or any other top exchange require KYC before using their service and we cannot do anything but to provide since this is the requirement that needed to submit before we can trade our coins there. Although its really risk is there we just need to be aware that certain like what you mentioned exist and we should never trust anyone especially those people sending random links and ignore them. Also we should always verify the messages we receive especially if they ask us to click the link and sign up something like our information or anything.

Fraudster right now find multiple ways to deceive people so we just need to be careful regarding on their possible attacks done and we should always put on our minds that never try to open anything unknown to us since this will totally put our life or holdings at huge risk to get hacked by criminals.

[Pandu Geddon]

This news will probably greatly impact users of the Binance centralized exchange in Hong Kong, or even other countries. however Binance is already one of the largest crypto exchanges in the world. and anyone will definitely believe in carrying out KYC there with the procedures required by the platform to carry out operations.

I don't know how the hackers carried out the fraud, but if it causes losses for Binance members, I think they have to solve this hacking problem quickly. Was it a mistake on the part of the user, or was there a system that was hacked and allowed hackers certain access to commit very obvious fraud to Binance users.

[Cookdata]

This is a serious matter, that's why its very important to get some of this guys to this forum so that they can learn and get updated just as this matter is discussed now.  Information as such quickly get verified by experienced people on the forum and that help investors to be cautious as they read through people's post and comment regarding the issue.

Another means to get rid of this scam strategy is for centralized exchanges to always keep their users aware of such actions and how to avoid it.

Even if they should come to the forum, before they get the right information, they would have lost all the things that they are assumed to be hidden have gotten to the wrong place. More than half of the population that know or use crypto today all used centralized exchanges because they learn from all the YouTubers and influencers that are always ready to give referral link to get bonuses. This are the wrong orientation new people that comes to the crypto get and the reason why hackers get more victims.

If new people that are joining crypto for the first time right refuse to use centralized exchanges, we can say that the future of crypto is in safe hands but the majority are here for the altcoins that can give that quick gain which are all situated on centralized exchanges, the data collection is not stopping anytime soon I guess.

[lalabotax]

How do hackers know who to send messages to?

Because they probably do have some centralized database of exchanges and they end up analyzing it. We sometimes find it difficult to know how hackers work from getting data, executing it, and cleaning it very quickly. that's why they are hackers. Moreover, if there are loopholes in the platform, then it will be easier for them to execute. And even though it is difficult to penetrate, we never know how often these hackers will try again and again until they can actually get in. And this doesn't only happen to Binance but also to all centralized platforms, cyber crimes are real and will always haunt us, nothing is truly 100% safe.

On the other hand, especially if hackers send messages randomly and some people who don't really understand this believe it, or even some people deliberately post the results of their investments on centralized exchanges, then this will really make it easier for hackers to work optimally. Well, actually, sometimes there is an element of negligence on our part and our own ignorance about the dangers of clicking on phishing links or believing in messages from someone we don't know. Better, just avoid and ignore it.

[Sandra_hakeem]

Yeahh, that's for sure. Denying themselves the access to manipulate your informations doesn't mean they don't have full control over it... From Thier ends, they can extract your informations and sell them out for various useful or malicious reasons...
It's quite unfortunate that we can't stay away totally from centralism... We would prolly avoid alot if we could.

Sandra 🧑‍🦰

[alastantiger]

How do hackers know who to send messages to?

Hong Kong police warned users of the scam in an Oct. 9 post to its Facebook page dubbed “CyberDefender.”

“Recently, fraudsters posing as Binance sent text messages claiming that users must click the link in the message to verify their identity details before a deadline, otherwise their account would be deactivated.”

Is the message randomly sent to people? I think the hackers target Hong Kong Binance users and that can only be from data breach or insider work.

I am shocked reading this even though I know it is something that is common. Shouldn't these crypto exchanges be at the top of their game when it comes to the data of their uses. What I'm trying to say here is that if they notice that they have had a security breach they shouldn't wait for hackers to send these scam messages to their customers rather this centralised exchanges should reach out to their customers via any means informing them of a scam or a hack and that they shouldn't respond to any email or phone call that asked them to click on a link or submit personal information. This may seem hard to accomplish but it will be worse if their user base starts to decline because people no longer trust them.