Hack and data leak across RoboEx, Mamura, SicretEx, karma-exchanger, ComCash...

[examplens]

Hack and leak hit 9 crypto exchangers: Barbados, Comedy, Telnet, RoboEx, Mamura, SicretEx, Karma-Exchanger, ComCash, Secrex.

A user with the handle LairF4ll posted a leak on the Exploit forum concerning several crypto exchangers: BarbadosExchange, Comedy, Telnet, RoboEx, Mamura, SicretEx, karma-exchanger, ComCash, and Secrex. Following the post, LairF4ll was banned from the Exploit forum, and the thread was deleted.
The central part of the leak is the user's FIO data: first name, last name and paternity (Specific to Russia), along with transaction logs. On the defaced page of comcash.exchange, it is stated that there is a database with 32,170 lines, of which 510 are publicly displayed in CSV format.
The comcash.exchange site currently contains information on seven alleged administrators, with pseudonyms, dates of birth, telephone numbers and email addresses.
- I have looked at these files and can confirm, but I will not share them here because they are sensitive. Although they are still available on comcash.exchange at the moment. There are also some logs of email correspondence.

What stands out, LairF4ll states that the whole group of these exchangers is most likely led by the same person or team. This is concluded on the basis that the brands share the same server, the same build manifest, the same Yandex.Metrica counter, the same Google verification string, emails from the same IP address and 81 out of 81 identical wallet addresses.

It is unclear why these exchanges collected information about users, especially if they presented themselves as no-kyc

[hugeblack]

Aside from the TXID, IP address, browser metadata, and a few bits of tracking data, what other information might they be storing?
It is also strange that no loss of funds has been reported, and the stated size of the project team is quite large for a project that relies on APIs. downloading these files could be dangerous.

[examplens]

Aside from the TXID, IP address, browser metadata, and a few bits of tracking data, what other information might they be storing?
It is also strange that no loss of funds has been reported, and the stated size of the project team is quite large for a project that relies on APIs. downloading these files could be dangerous.

It is obvious evidence that codebases and infrastructure have been compromised. This makes all the mentioned services unreliable for further use. We cannot know whether the hacker still has access to sensitive parts, regardless of the changed domains.
It seems like a white hack, because the primarily exposed problem is that it is not about no-KYC services as they are presented. He is pointing to a certain @comedy_club from the Exploit forum of being behind all these services.
Since @LairF4ll had access to modify files, couldn't he have exploited that to drain exchange funds or replace deposit addresses with his own?