FB pixel

User IDs and passport data leaks for 230K crypto users in Iran

User IDs and passport data leaks for 230K crypto users in Iran

A data leak from Iranian crypto exchange bit24.cash has exposed personal data from nearly 230,000 Iranian citizens, according to Cybernews.

Iran has taken up cryptocurrency significantly due to limited access to foreign markets. In 2023, Iranian crypto exchanges saw almost $3 billion in transactions.

Bit24.cash supports over 300 coins and tokens. Users complete a KYC process where they confirm their identity by uploading identity documents.

Cybernews researchers found a misconfigured MinIO that granted access to S3 buckets containing users’ KYC data. MinIO is an S3 compatible object storage system for large scale machine learning and data workloads.

The misconfiguration exposed users’ passports, ID documents, and credit cards, as well as written consent to regulations. The leak has since now been secured, according to the report.

“This breach poses a severe threat, as threat actors could potentially exploit the exposed data for identity theft, fraudulent transactions, and phishing attacks,” said the Cybernews researchers. “With access to such comprehensive personal and financial data, malicious actors could impersonate individuals, gain unauthorized access to accounts, execute fraudulent transactions, and potentially cause substantial financial and personal harm to the affected users.”

Hossein Amini, a security engineer at bit24.cash, officially responded to the claims on behalf of the company via email to Cybernews. The company says the claims are “inaccurate and misleading,” alleging it found no evidence of a data breach or unauthorized access to user information.

“The reference to a misconfigured MinIO instance granting access to S3 buckets containing KYC data is wholly untrue and does not align with our system architecture or security protocols,” said Amini. “We can confirm that our MinIO setup and cloud storage containers remain secure, and there has been no unauthorized access to any sensitive user data.”

An Ondato report delved into the relationship between ID documents and cryptocurrency fraud last year.

Article Topics

 |   |   |   | 

Latest Biometrics News


U.S. academic institutions get biometric upgrades with new partnerships

A press release says ROC (formerly Rank One Computing), which provides U.S.-made biometrics and computer vision for military, law enforcement…


Smart Bangladesh 2041: Balancing ambition with reality

Bangladesh aims to be a “Smart” nation by 2041 as the country goes through a drastic transformation founded on digital identity…


Nigeria’s NIMC introducing one multi-purpose digital ID card, not three

The National Identity Management Commission of Nigeria (NIMC) has clarified that only one new digital ID card with multiple functions…


Age assurance tech is ready now, and international standards are on their way

The Global Age Assurance Standards Summit has wrapped up, culminating in a set of assertions, a seven-point call-to-action and four…


NIST finds biometric age estimation effective in first benchmark, coming soon

The U.S. National Institute of Standards and Technology presented a preview of its assessment of facial age estimation with selfie…


Maryland bill on police use of facial recognition is ‘strongest law in the nation’

Maryland has passed one of the more stringent laws governing the use of facial recognition technology by law enforcement in…


Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Most Read From This Week

Featured Company

Biometrics Insight, Opinion

Digital ID In-Depth

Biometrics White Papers

Biometrics Events