Binance, the world’s largest cryptocurrency exchange by trading volume, said it’s investigating into the alleged leak of its customers’ verification information. The leak could affect up to 60,000 individual users who sent KYC information to the company in 2018 and 2019.
This leak is allegedly directly related to the 7,000 bitcoin hack last May.
On Wednesday, a Telegram group created by an admin under the pseudonym Guardian M distributed hundreds of images of individuals holding their IDs and a piece of paper written with “Binance, 02/24/19,” alleging that data was hacked from the exchange. The hacker supplied CoinDesk with a hundreds of photographs and we have identified a number of users who recognize the photos of their faces and personal IDs that they sent into Binance for know-your-customer purposes.
Know-your-customer, or KYC, is a legal requirement by financial institutions to collect identifying information for all customers attempting to trade, withdraw, and deposit.
In a response on Wednesday, Binance said the information circulated in the Telegram channel does not match data inside Binance’s own system, and as such said there’s no evidence so far to show it’s directly coming from the exchange itself.
“These images do not contain the digital watermark imprinted by our system,” the company said. “Our security team is hard at work pursuing all possible leads in an attempt to identify the source of these images, as it remains unclear where they were obtained.”
Binance added that the unidentified individual previously demanded 300 BTC from it for “withholding 10,000 photos that bear similarity to Binance KYC data.” After Binance refused to continue the conversation, the individual started distributing the photos online and to media outlets.
In fact, since Monday this week, CoinDesk have already reached out to several people whose ID images, among hundreds of others, were first uploaded to a publicly available cloud drive and were later circulating in the Telegram group today.
At least two individuals confirmed to CoinDesk the authenticity of the images and on the submission of such images to Binance.com on Feb. 24 2018.
One of the two individuals, who asked to remain anonymous, showed CoinDesk his login history onto Binance.com from January 2018, when he first registered the account, via email alerts he received every time he went onto the site.
The email alert history indicates he did log into Binance.com, on Feb. 24, 2018 around 5:00 UTC.
Further, this individual showed CoinDesk an ID image of his saved on his phone taken on Feb. 24 around 6:00 UTC, which appears identical to the one that’s circulating inside the Telegram group.
One user we contacted could have been a victim of identity theft. The photograph we analyzed contained a face similar to the victims but incorrect address information.
An error-level anaylsis ofd the photo suggests that the some of the image had been modified. “Similar edges should have similar brightness in the ELA result,” wrote the photo forensics site FotoForensics. “All high-contrast edges should look similar to each other, and all low-contrast edges should look similar. With an original photo, low-contrast edges should be almost as bright as high-contrast edge.”
In today’s response, Binance said that around February 2018, it had contracted a third-party vendor to handle know-your-customer verification “in order to handle the high volume of requests at that time.”
The exchange did not elaborate on to what degree this third party vendor was give access to the know-your-customer data or whether it was able to obtain the actual image files on premise.
“Currently, we are investigating with the third-party vendor for more information. We are continuing to investigate and will keep you informed,” the company said.
Changpeng Zhao image via CoinDesk
Like what you read? Give us one like or share it to your friends