Actor claims to sell exchange user data with 'wealth scores'
A threat actor on an underground forum claims to sell full data of users of a Singapore-headquartered cryptocurrency exchange: names, emails, phone numbers, home addresses, dates of birth, SSNs for some records, plus a per-person 'wealth score'. No record count or price was given and the exchange has not confirmed an incident; DailyDarkWeb assesses the samples look like people-lookup service output rather than a direct breach. The list would feed phishing, SIM swaps and extortion; customers should stay alert to suspicious contacts.
What happened
A seller on an underground forum claims to offer full data of users of a Singapore-headquartered cryptocurrency exchange, each record with a 'wealth score'. The post gives no record count or price, and the exchange has not confirmed any incident. The claim is unverified.
Why it matters
If real, criminals would hold a ready-made list of crypto holders ranked by wealth for phishing, SIM swaps and extortion. The visible samples show US residents and some records would include SSNs, raising the risk of financial fraud against those customers.
What to do
Warn customers about contact attempts and scams, strengthen two-factor authentication and monitor accounts for suspicious activity. Treat the claim as unconfirmed until the exchange issues an official statement.
For the technical team
- Affected
- Exchange de criptomoedas com sede em Singapura (nome não divulgado no post); base alegada de usuários com dados pessoais · Users of a Singapore-headquartered cryptocurrency exchange (name not given in the post). Visible sample entries are US residents.
- Exploitation
- Sale claim reported by DailyDarkWeb. No record count, no price, no confirmation from the exchange. Per the source, this is an unverified threat-actor claim, not confirmation of a breach.
- Fix
- No fix applicable. Mitigation indicated in the source's analysis: caution with phishing, SIM swaps and physical extortion aimed at crypto holders.
- Vector
- No technical vector described. This is a claimed data sale on an underground forum; the source does not say how the data was obtained.
- More details
- DailyDarkWeb analyst note: each sample row starts with a search 'target', a people-lookup service pattern; the material looks like an enriched list of likely crypto holders rather than a direct exchange breach. Buyers are told to message the seller. The X post uses the hashtag #CryptoCom; the ad text does not name the platform.
Timeline
Underground forum post advertises user database with 'wealth scores'.
Sources 1 source
- @DailyDarkWeb @DailyDarkWeb
