♻️ ComCash - Anonymous Exchange ✅ NO KYC ✅ Escrow $21,000

[100bitcoin]

I think that the priority here should be to get an explanation of the problem that is mentioned on other forums and is related to the ComCash exchange.
User data has leaked from one of the connected exchanges: Comedy Cash / Barbados Exchange / ComCash. Also, a few more services
All hacked data has been left available for download on an exploit forum.

This exchange has been hacked and the site has been modified by hackers. Messages such as "Closed Forever" and "Applications are no longer accepted" have been left.
Furthermore, all details regarding the individuals behind Comcash have been published.

Do you mean ComCash has been hacked and people may loose fund by using ComCash.app or ComCash.dev?

But, then who is the following?

We are happy to announce that, after such a long time, we have returned to the forum!

We have long-term plans and big ambitions! Join the discussion!

[examplens]

Do you mean ComCash has been hacked and people may loose fund by using ComCash.app or ComCash.dev?

But, then who is the following?

We are happy to announce that, after such a long time, we have returned to the forum!

We have long-term plans and big ambitions! Join the discussion!

As far as I can see, on all listings, including in the signature campaign, they use the https://comcash.exchange/ domain, which is obviously hacked. Just go to the site, the translation feature is fine if you're not comfortable with Russian. Now I see that they shut down the original domain, the first post in this ANN was edited, and obviously the links were replaced with new domains.
Archive: https://bitlist.co/post/63997893/versions#edit5
If it is hacked on one domain, it is an obvious risk that there is a bug on all other domains connected to this exchange.

[AakZaki]

Looking at some questions that were not responded to by the ComCASH team, it seems that there is indeed a problem related to the site, as said by @examplens .

And I think @icopress need to know about this if it is not notified by the ComCASH team, because ANN campaigns and signatures still use the comcash.exchange link and comcash.cc.
while the link in ANN has changed to comcash.dev and comcash.app.

If we look more closely, there are the following peculiarities:

• link comcash.exchange and comcash.cc. does not have a favicon
• link comcash.dev and comcash.app have favicons

Note this Logo also on the site:

comcash.exchange & comcash.cc

comcash.dev & comcash.app

Looking at the logo on the site: comcash.exchange & comcash.cc looks like it was hacked because there is an extra letter R (edited logo)

[icopress]

And I think @icopress need to know about this if it is not notified by the ComCASH team, because ANN campaigns and signatures still use [...]

I’m still waiting for a decision from the team; the campaign itself is fine.

It’s just not clear yet whether new domains will be used or if the old ones will remain.

[hugeblack]

I think that the priority here should be to get an explanation of the problem that is mentioned on other forums and is related to the ComCash exchange.
User data has leaked from one of the connected exchanges:

It seems to have happened sometime between October 29 and 30, 2026; a reply from @zasad@ indicated that the service was operational, but when I visited the site, I was surprised by what I found. It is unfortunate to hear this, and I hope the damage was limited.

[examplens]

I’m still waiting for a decision from the team; the campaign itself is fine.

It’s just not clear yet whether new domains will be used or if the old ones will remain.

I think the old https://comcash.exchange/ will probably not be used again. The defaced page is still there, with the possibility to download files containing leaked data, correspondence logs... I'm not sure how much control Comcash have over this site.

Also, it remains open and they give answers as to why they keep user data in the database

[zasad@]

I would wait for official announcements.
Comcash does not ask users for their full names, mobile phone numbers, or email addresses. Therefore, this data could have been stolen from another source or simply generated. It is clear to me that the site has been compromised, but I see no reason to trust any of the other information for now.

[blockman]

Both websites from OP are no longer accessible the .app and .dev it says that the server is down.

Code:

Web server is down 
Error code 521 

Whilst the .exchange domain is accessible but it's loading forever on my browser. I hope that the team was able to control the damage and will be back soon. I guess it's more important to do the necessary actions before they give any statement of what had just happened.

[joniboini]

It seems like I missed the hack. Seems like the clearnet is still not yet recovered. Why not change the link in sig with the onion link for the moment? Wouldn't it be safer to since there's a possibility the hacker changed the web to do something more malicious?

[examplens]

I would wait for official announcements.
Comcash does not ask users for their full names, mobile phone numbers, or email addresses. Therefore, this data could have been stolen from another source or simply generated. It is clear to me that the site has been compromised, but I see no reason to trust any of the other information for now.

According to what was stated, it is a group of ten exchanges/mixers. It is not clearly stated through which service the data was collected. Comcash is part of that group

It seems like I missed the hack. Seems like the clearnet is still not yet recovered. Why not change the link in sig with the onion link for the moment? Wouldn't it be safer to since there's a possibility the hacker changed the web to do something more malicious?

It’s actually quite a strange situation. The websites are currently inaccessible, but the servers haven’t been completely shut down. I left pages open in my browser and now I see that some of the files the hacker left are still there and anyone can access them.
For example:

Code:

example of clients -> https://comcash.exchange/downloads/CCDBNAM.csv
code -> https://comcash.exchange/downloads/Comcash.tar
How NOT to Run... -> https://comcash.exchange/downloads/METODICHKA-1.pdf
Correspodence -> https://comcash.exchange/downloads/%D0%B8%D0%BC%D0%B5%D0%B9%D0%BB%D1%8B.txt

[icopress]

This is a statement from ComCash, which I received from the owner:

Our project has been subjected to an attack; we do not know who organized it or why. One thing we can say for certain: in over three years of operation, we have never been involved in any form of deception toward our clients, and we have always strived to provide services of the highest standard.

We guarantee that no client data has been shared with third parties, as we do not collect such data. All the information currently being actively circulated by malicious actors—including claims about projects we are supposedly linked to, personal client data, instructions, and more—is compromised and bears no relation to reality.

We are currently working on restoring our service infrastructure and will keep you updated. For the time being, Bitcointalk is the only reliable channel for communication.

Thank you!

[zasad@]

I would wait for official announcements.
Comcash does not ask users for their full names, mobile phone numbers, or email addresses. Therefore, this data could have been stolen from another source or simply generated. It is clear to me that the site has been compromised, but I see no reason to trust any of the other information for now.

According to what was stated, it is a group of ten exchanges/mixers. It is not clearly stated through which service the data was collected. Comcash is part of that group

It seems like I missed the hack. Seems like the clearnet is still not yet recovered. Why not change the link in sig with the onion link for the moment? Wouldn't it be safer to since there's a possibility the hacker changed the web to do something more malicious?

It’s actually quite a strange situation. The websites are currently inaccessible, but the servers haven’t been completely shut down. I left pages open in my browser and now I see that some of the files the hacker left are still there and anyone can access them.
For example:

Code:

example of clients -> https://comcash.exchange/downloads/CCDBNAM.csv
code -> https://comcash.exchange/downloads/Comcash.tar
How NOT to Run... -> https://comcash.exchange/downloads/METODICHKA-1.pdf
Correspodence -> https://comcash.exchange/downloads/%D0%B8%D0%BC%D0%B5%D0%B9%D0%BB%D1%8B.txt

I’ve looked at some data and come across a few things that I don’t quite understand: a client exchanges one cryptocurrency for another and provides the exchange service with a significant amount of personal data. Typically, exchanges don’t ask for personal data for such transactions the process usually works just like it does with the service mentioned in your signature.
Anonymous Exchange does not request personal data, so do not trust scammers who have published such information.

[joniboini]

I'm not really comfortable accessing some files from a hacker, but as far as I'm aware such detailed personal data was never collected in any instant swap service I've come across. Maybe it's about swap ID and txs, not real name, address, and so on. One thing for certain though, the number of attacks targeting exchanges/instant swap services have only increased, hopefully they'll recover and increase the security asap.

[Arhad]

I would wait for official announcements.
Comcash does not ask users for their full names, mobile phone numbers, or email addresses. Therefore, this data could have been stolen from another source or simply generated. It is clear to me that the site has been compromised, but I see no reason to trust any of the other information for now.

According to what was stated, it is a group of ten exchanges/mixers. It is not clearly stated through which service the data was collected. Comcash is part of that group

It seems like I missed the hack. Seems like the clearnet is still not yet recovered. Why not change the link in sig with the onion link for the moment? Wouldn't it be safer to since there's a possibility the hacker changed the web to do something more malicious?

It’s actually quite a strange situation. The websites are currently inaccessible, but the servers haven’t been completely shut down. I left pages open in my browser and now I see that some of the files the hacker left are still there and anyone can access them.
For example:

Code:

example of clients -> https://comcash.exchange/downloads/CCDBNAM.csv
code -> https://comcash.exchange/downloads/Comcash.tar
How NOT to Run... -> https://comcash.exchange/downloads/METODICHKA-1.pdf
Correspodence -> https://comcash.exchange/downloads/%D0%B8%D0%BC%D0%B5%D0%B9%D0%BB%D1%8B.txt

I’ve looked at some data and come across a few things that I don’t quite understand: a client exchanges one cryptocurrency for another and provides the exchange service with a significant amount of personal data. Typically, exchanges don’t ask for personal data for such transactions the process usually works just like it does with the service mentioned in your signature.
Anonymous Exchange does not request personal data, so do not trust scammers who have published such information.

You probably haven't examined the data closely if you're drawing conclusions like that. The document includes phone numbers and bank card details collected during exchanges involving Russian rubles. The email addresses may have been obtained when users registered on the exchange site or during the exchange process, when they were sent updates on their transaction status.

[zasad@]

I would wait for official announcements.
Comcash does not ask users for their full names, mobile phone numbers, or email addresses. Therefore, this data could have been stolen from another source or simply generated. It is clear to me that the site has been compromised, but I see no reason to trust any of the other information for now.

According to what was stated, it is a group of ten exchanges/mixers. It is not clearly stated through which service the data was collected. Comcash is part of that group

It seems like I missed the hack. Seems like the clearnet is still not yet recovered. Why not change the link in sig with the onion link for the moment? Wouldn't it be safer to since there's a possibility the hacker changed the web to do something more malicious?

It’s actually quite a strange situation. The websites are currently inaccessible, but the servers haven’t been completely shut down. I left pages open in my browser and now I see that some of the files the hacker left are still there and anyone can access them.
For example:

Code:

example of clients -> https://comcash.exchange/downloads/CCDBNAM.csv
code -> https://comcash.exchange/downloads/Comcash.tar
How NOT to Run... -> https://comcash.exchange/downloads/METODICHKA-1.pdf
Correspodence -> https://comcash.exchange/downloads/%D0%B8%D0%BC%D0%B5%D0%B9%D0%BB%D1%8B.txt

I’ve looked at some data and come across a few things that I don’t quite understand: a client exchanges one cryptocurrency for another and provides the exchange service with a significant amount of personal data. Typically, exchanges don’t ask for personal data for such transactions the process usually works just like it does with the service mentioned in your signature.
Anonymous Exchange does not request personal data, so do not trust scammers who have published such information.

You probably haven't examined the data closely if you're drawing conclusions like that. The document includes phone numbers and bank card details collected during exchanges involving Russian rubles. The email addresses may have been obtained when users registered on the exchange site or during the exchange process, when they were sent updates on their transaction status.

Let me explain my perspective in a way that’s easier to follow.
Can you prove to me that the published customer data actually belongs to ComCASH?

I took some addresses from the file- picking them at random from the beginning and the end, and the most recent transactions for these addresses occurred more than two years ago; for some, it’s been over a year.
https://blockchair.com/bitcoin/address/bc1q9c6w35k3049xv0r5j7x6tlyp63lud756ta20ux
https://blockchair.com/ru/bitcoin-cash/address/qpnewwexv2pyz47aa9ytvlugz2pnfn58vqd4mxv86q
https://blockchair.com/bitcoin/address/bc1qwuvxf8ugtaw0cl6m52sapqk9tyrm4c6lc0k09s

This is old data, and I don’t know where it was stolen from, but if you have more information, please publish it.

[Arhad]

Let me explain my perspective in a way that’s easier to follow.
Can you prove to me that the published customer data actually belongs to ComCASH?

I took some addresses from the file- picking them at random from the beginning and the end, and the most recent transactions for these addresses occurred more than two years ago; for some, it’s been over a year.
https://blockchair.com/bitcoin/address/bc1q9c6w35k3049xv0r5j7x6tlyp63lud756ta20ux
https://blockchair.com/ru/bitcoin-cash/address/qpnewwexv2pyz47aa9ytvlugz2pnfn58vqd4mxv86q
https://blockchair.com/bitcoin/address/bc1qwuvxf8ugtaw0cl6m52sapqk9tyrm4c6lc0k09s

This is old data, and I don’t know where it was stolen from, but if you have more information, please publish it.

I don't have any inside information, so I can't know for certain whether these personal details belong to Comcash customers. Comcash handled fiat currencies, so customers may have provided phone numbers and bank card details to complete exchanges.

You're right that this doesn't prove the leaked data belongs to Comcash customers. But your investigation doesn't prove that the data came from a third-party source and isn't connected to Comcash, either.

[examplens]

Let me explain my perspective in a way that’s easier to follow.
Can you prove to me that the published customer data actually belongs to ComCASH?

The files in question are from one of the hacked group of exchanges, and for which there is fairly solid evidence that they are under the control of the same person-team. Comcash is part of that group.
I wrote more about it in a separate topic https://bitcointalk.org/index.php?topic=5598441.0

It is very likely that the leaked data is not from Comcash, but the problem is that someone had access to the server and the data on it.

[zasad@]

Let me explain my perspective in a way that’s easier to follow.
Can you prove to me that the published customer data actually belongs to ComCASH?

I took some addresses from the file- picking them at random from the beginning and the end, and the most recent transactions for these addresses occurred more than two years ago; for some, it’s been over a year.
https://blockchair.com/bitcoin/address/bc1q9c6w35k3049xv0r5j7x6tlyp63lud756ta20ux
https://blockchair.com/ru/bitcoin-cash/address/qpnewwexv2pyz47aa9ytvlugz2pnfn58vqd4mxv86q
https://blockchair.com/bitcoin/address/bc1qwuvxf8ugtaw0cl6m52sapqk9tyrm4c6lc0k09s

This is old data, and I don’t know where it was stolen from, but if you have more information, please publish it.

I don't have any inside information, so I can't know for certain whether these personal details belong to Comcash customers. Comcash handled fiat currencies, so customers may have provided phone numbers and bank card details to complete exchanges.

You're right that this doesn't prove the leaked data belongs to Comcash customers. But your investigation doesn't prove that the data came from a third-party source and isn't connected to Comcash, either.

Of all the files, I took a look at CCDBNAM.csv, and it immediately struck me as concerning that these logs lack any date or time informationdata that should certainly be present. I see no point in examining the remaining files, as I cannot be sure they are safe (free of viruses), and I am not an expert in this field.

Let me explain my perspective in a way that’s easier to follow.
Can you prove to me that the published customer data actually belongs to ComCASH?

The files in question are from one of the hacked group of exchanges, and for which there is fairly solid evidence that they are under the control of the same person-team. Comcash is part of that group.
I wrote more about it in a separate topic https://bitcointalk.org/index.php?topic=5598441.0

It is very likely that the leaked data is not from Comcash, but the problem is that someone had access to the server and the data on it.

I’ll add my 5 cents to your thread.