Hack and data leak across RoboEx, Mamura, SicretEx, karma-exchanger, ComCash...

[examplens]

Hack and leak hit 9 crypto exchangers: Barbados, Comedy, Telnet, RoboEx, Mamura, SicretEx, Karma-Exchanger, ComCash, Secrex.

A user with the handle LairF4ll posted a leak on the Exploit forum concerning several crypto exchangers: BarbadosExchange, Comedy, Telnet, RoboEx, Mamura, SicretEx, karma-exchanger, ComCash, and Secrex. Following the post, LairF4ll was banned from the Exploit forum, and the thread was deleted.
The central part of the leak is the user's FIO data: first name, last name and paternity (Specific to Russia), along with transaction logs. On the defaced page of comcash.exchange, it is stated that there is a database with 32,170 lines, of which 510 are publicly displayed in CSV format.
The comcash.exchange site currently contains information on seven alleged administrators, with pseudonyms, dates of birth, telephone numbers and email addresses.
- I have looked at these files and can confirm, but I will not share them here because they are sensitive. Although they are still available on comcash.exchange at the moment. There are also some logs of email correspondence.

What stands out, LairF4ll states that the whole group of these exchangers is most likely led by the same person or team. This is concluded on the basis that the brands share the same server, the same build manifest, the same Yandex.Metrica counter, the same Google verification string, emails from the same IP address and 81 out of 81 identical wallet addresses.

It is unclear why these exchanges collected information about users, especially if they presented themselves as no-kyc

[hugeblack]

Aside from the TXID, IP address, browser metadata, and a few bits of tracking data, what other information might they be storing?
It is also strange that no loss of funds has been reported, and the stated size of the project team is quite large for a project that relies on APIs. downloading these files could be dangerous.

[examplens]

Aside from the TXID, IP address, browser metadata, and a few bits of tracking data, what other information might they be storing?
It is also strange that no loss of funds has been reported, and the stated size of the project team is quite large for a project that relies on APIs. downloading these files could be dangerous.

It is obvious evidence that codebases and infrastructure have been compromised. This makes all the mentioned services unreliable for further use. We cannot know whether the hacker still has access to sensitive parts, regardless of the changed domains.
It seems like a white hack, because the primarily exposed problem is that it is not about no-KYC services as they are presented. He is pointing to a certain @comedy_club from the Exploit forum of being behind all these services.
Since @LairF4ll had access to modify files, couldn't he have exploited that to drain exchange funds or replace deposit addresses with his own?

[Pmalek]

It is also strange that no loss of funds has been reported...

Maybe it was never the goal of the person who carried out the hack to steal the crypto. It looks weird writing this, I know. It looks more like it's an attack on the exchange owners and staff members and the way they handled sensitive information of customers. He is calling them out for doing a bad job. But you are right about the potential dangers of downloading and opening those files.

[hugeblack]

It is also strange that no loss of funds has been reported...

Maybe it was never the goal of the person who carried out the hack to steal the crypto.

+1
The whole story is highly suspicious. I am still waiting for a response from the team to find out what happened, but it is clear that the hackers are very familiar with the platform—or, at the very least, there is some connection between them.

[Trêvoid]

these services operate as a single entity despite appearing independent.

also regardless of curiosity, the archives of leaked files may contain trackers or malware be aware.

Best regards,
— Trêvoid

[ultrloa]

It is also strange that no loss of funds has been reported...

Maybe it was never the goal of the person who carried out the hack to steal the crypto. It looks weird writing this, I know. It looks more like it's an attack on the exchange owners and staff members and the way they handled sensitive information of customers. He is calling them out for doing a bad job. But you are right about the potential dangers of downloading and opening those files.

I'm thinking about possible two scenarios happening here.

Maybe they just want to damage the reputation of those platforms, since most of them says that they don't require KYC. But at the end of the day, they are still collecting the data of their costumers.

Second is maybe they see the importance of the data they stole from those platforms, since they can use it for long term. They can do profiling to identify who are their high valued targets.

[zasad@]

I’ll add my two cents.

https://www.bestchange.ru/

This is the largest aggregator of crypto exchange services in Russia; you can find dozens of websites there that all share the same interface.

Since I am from Russia and understand how this business operates, I can tell you that these exchanges often use the same platform, and a single administrator may manage dozens of them. These services frequently collaborate, sharing both clients and liquidity.

In the file containing transaction data for 2024–2025, the hacker leaked customer information and is now inviting those same customers to join a Telegram group

In Russia, such actions can lead to severe, even fatal, physical retaliation. If you are waging a war against an exchange service, you have no right to publicly disclose the personal data of its clients. A reasonable hacker would have kept phone numbers, full names, and bank card details private.

I would surmise that this looks like a personal vendetta, but the hacker has crossed the line and caused harm to hundreds of people who are completely innocent.

Think about this and consider whether you can trust a hacker who gives no thought to the consequences of their actions and whose primary goal is revenge.

Don’t think that I’m defending ComCash, I’ve pointed out a few things to you that I really don’t like.

[RGBTC]

It is unclear why these exchanges collected information about users, especially if they presented themselves as no-kyc

If the hacker’s claim is true that all these exchanges are interconnected and one of them facilitates crypto-to-fiat conversions then, generally speaking, such an exchange would eventually require more specific customer information.

By the way, was these services ever well-known? I can’t even find it properly indexed on Google. I’ve only heard of one of them, and that was in the context of scam accussations: ?topic=5582382.0