Iranian crypto exchange Bit24 reportedly leaks 230,000 users’ KYC data

Iranian crypto exchange Bit24.cash has reportedly leaked the personal and financial details of its 230,000 users following a security flaw in its know-your-customer (KYC) database.

The exchange’s KYC and anti-money laundering (AML) measures stipulate that users must submit a photo of themselves alongside their ID, credit card, and written consent to trade on the site.  

However, a report from Cybernews details a flaw in the exchange’s cloud software that has let slip the identifying details of its customers. According to the report, researchers accessed KYC data stored in S3 buckets, a form of cloud storage, by exploiting a misconfigured MinIO.  

Read more: Chinese billionaire behind Himalaya Exchange indicted for $1B scheme

Researchers say this flaw “poses a severe threat, as threat actors could potentially exploit the exposed data for identity theft, fraudulent transactions, and phishing attacks.” 

They added, “With access to such comprehensive personal and financial data, malicious actors could impersonate individuals, gain unauthorized access to accounts, execute fraudulent transactions, and potentially cause substantial financial and personal harm.”

According to crypto analytics firm TRM Labs, Bit24 is the fifth largest crypto exchange in Iran when it comes to incoming volume.

Bit24 responded to the Cybernews report, calling it “inaccurate and misleading.” A security engineer said, “The reference to a misconfigured MinIO instance granting access to S3 buckets containing KYC data is wholly untrue and does not align with our system architecture or security protocols.”

The engineer said Bit24’s security is one of its ‘utmost priorities’ and that concerned users should contact the exchange. According to Cybernews, the security flaw is no longer present.  

Protos has contacted Bit24 and Cybernews for comment and we’ll update this piece if and when we receive a reply.

Got a tip? Send us an email or ProtonMail. For more informed news, follow us on X, Instagram, Bluesky, and Google News, or subscribe to our YouTube channel.