Binance Customer Data Has Leaked: What We Know and What We Don't

Binance, the world's largest cryptocurrency exchange by trading volume, said it's investigating the alleged leak of its customers' verification information.

This leak is said to be directly related to a hack that nabbed 7,000 bitcoin last May. On Wednesday, a Telegram group created by an admin under the pseudonym "Guardian M" distributed hundreds of images of individuals holding their IDs and pieces of paper written with "Binance, 02/24/19," alleging that the data presented was hacked from the exchange.

The hacker supplied CoinDesk with hundreds of photographs and we have identified a number of users who recognize the photos of their faces and personal IDs that they sent into Binance for know-your-customer purposes.

In a response on Wednesday, Binance said the information circulated in the Telegram channel does not match data in Binance's own internal system, and as such said there's no evidence so far to show it's directly coming from the exchange itself.

Binance added that the unidentified individual previously demanded 300 BTC from it for "Withholding 10,000 photos that bear similarity to Binance KYC data." After Binance refused to continue the conversation, the individual started distributing the photos online and to media outlets.

Two individuals confirmed to CoinDesk the authenticity of the images and that they submitted such images to Binance.com on Feb. 24 2018.

The second individual told CoinDesk that he received an email from Binance's customer support on Feb. 24 as he was trying to make the size of his submitted image correct.

He added the email was sent from an email address with a binance.

In today's response, Binance said that around February 2018, it had contracted a third-party vendor to handle know-your-customer verification "In order to handle the high volume of requests at that time."

The exchange did not elaborate on to what degree this third-party vendor was give access to the know-your-customer data or whether it was able to obtain the actual image files on premise.