Spread the love

Binance Customer Data Is Leaking: What We Know and What We Don’t

Originally published on: CoinDesk
Read the original article

August 07, 2019


news

Binance, the world’s largest cryptocurrency exchange by trading volume, said it’s investigating the alleged leak of its customers’ verification information. The leak could allegedly affect up to 60,000 individual users who sent KYC information to the company in 2018 and 2019.

This leak is allegedly directly related to a hack that nabbed 7,000 bitcoin last May.

On Wednesday, a Telegram group created by an admin under the pseudonym Guardian M distributed hundreds of images of individuals holding their IDs and a piece of paper written with “Binance, 02/24/19,” alleging that data was hacked from the exchange. The hacker supplied CoinDesk with a hundreds of photographs and we have identified a number of users who recognize the photos of their faces and personal IDs that they sent into Binance for know-your-customer purposes.

The hacker told CoinDesk that he or she has at least 60,000 more and that he will release them over time. We have access to nearly a thousand.

Know-your-customer, or KYC, is a legal requirement by financial institutions to collect identifying information for all customers attempting to trade, withdraw, and deposit.

In a response on Wednesday, Binance said the information circulated in the Telegram channel does not match data inside Binance’s own system, and as such said there’s no evidence so far to show it’s directly coming from the exchange itself.

“These images do not contain the digital watermark imprinted by our system,” the company said. “Our security team is hard at work pursuing all possible leads in an attempt to identify the source of these images, as it remains unclear where they were obtained.”

Binance added that the unidentified individual previously demanded 300 BTC from it for “withholding 10,000 photos that bear similarity to Binance KYC data.” After Binance refused to continue the conversation, the individual started distributing the photos online and to media outlets.

In fact, since Monday this week, CoinDesk have already reached out to three people whose ID images, among hundreds of others, were first uploaded to a publicly available cloud drive and were later circulating in the Telegram group today.

Two individuals confirmed to CoinDesk the authenticity of the images and on the submission of such images to Binance.com on Feb. 24 2018.

One of the two individuals, who asked to remain anonymous, showed CoinDesk his login history onto Binance.com from January 2018, when he first registered the account, via email alerts he received every time he went onto the site.

The email alert history indicates he did log into Binance.com, on Feb. 24, 2018 around 5:00 UTC.

Further, this individual showed CoinDesk an ID image of his saved on his phone taken on Feb. 24 around 6:00 UTC, which appears identical to the one that’s circulating inside the Telegram group.

Another user we contacted could have been a victim of identity theft. The photograph we analyzed contained a face similar to the victims but incorrect address information.

An error-level analysis of the photo suggests that the some of the image had been modified, especially the brighter edges in the photo above. “Similar edges should have similar brightness in the ELA result,” wrote the photo forensics site FotoForensics. “All high-contrast edges should look similar to each other, and all low-contrast edges should look similar. With an original photo, low-contrast edges should be almost as bright as high-contrast edge.”

In today’s response, Binance said that around February 2018, it had contracted a third-party vendor to handle know-your-customer verification “in order to handle the high volume of requests at that time.”

The exchange did not elaborate on to what degree this third party vendor was give access to the know-your-customer data or whether it was able to obtain the actual image files on premise.

“Currently, we are investigating with the third-party vendor for more information. We are continuing to investigate and will keep you informed,” the company said.

Image via hacked files

Tags: , , , , , , ,

Related Article