AlphaEx · Breach

Threat actor alleges leak of 20GB KYC documents from AlphaEx

Nov 04, 2026 · 1 min read

A threat actor on a dark web forum claims to have posted 20GB with more than 15,000 KYC documents from cryptocurrency exchange AlphaEx, including passports, driving licenses and government-issued IDs. As proof, the poster shared direct links to images on an AlphaEx API domain, but the exchange has not confirmed any incident. Customers should watch for phishing and identity fraud.

By HIFY Radar newsroom Updated 11/04/2026 06:54 AM Get this every day →← Back to the feed 1 source

MediumBreachNo software to update

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

A threat actor claims to have posted on a dark web forum 20GB with more than 15,000 customer KYC identity documents from cryptocurrency exchange AlphaEx. The material allegedly includes passport scans, driving licenses and government-issued ID cards, supposedly pulled from the exchange's own backend storage. AlphaEx has not confirmed any incident.

Why it matters

If confirmed, the material exposes identity data that enables identity fraud, account takeover and targeted phishing against customers. KYC documents are used in financial verification, which raises the risk for affected people and for the exchange's reputation.

What to do

AlphaEx customers should change passwords, enable two-factor authentication and distrust messages asking for personal data. Security teams should monitor fraud attempts with this data and watch for an official AlphaEx statement.

For the technical team

Affected: AlphaEx, exchange de criptomoedas; conjunto alegado de 20 GB com mais de 15 mil documentos de identidade KYC · AlphaEx, cryptocurrency exchange; alleged 20GB set of more than 15,000 KYC identity documents.
Exploitation: Unverified threat-actor claim on a dark web forum, reported by @DailyDarkWeb. No confirmation from AlphaEx and no confirmed exploitation.
Fix: No fix applicable; data leak incident unconfirmed by the company.
Vector: Component: the exchange's backend storage, per the actor. Flaw: image files apparently hosted on an AlphaEx API domain reachable from outside, in the @DailyDarkWeb assessment. Access path unconfirmed.
More details: The alleged set includes passports, driving licenses and government-issued ID cards. As proof, the poster shared direct links to image files that appear to sit on an AlphaEx API domain. Risks cited by @DailyDarkWeb: identity fraud, account takeover and targeted phishing.