Israel Crypto Data Breach: Disrupt0r Leaks Binance and OKX KYC Records

Threat intelligence analysts are currently investigating a massive Israel crypto data breach orchestrated by a hacktivist entity operating under the moniker “Disrupt0r.” The group has released a compromised database containing over 600 highly sensitive Know Your Customer (KYC) records, specifically targeting Israeli nationals utilizing major cryptocurrency exchanges.

⚠️ THREAT INTELLIGENCE ADVISORY:
The threat actor “Disrupt0r” has published a spreadsheet containing verified client records purportedly extracted from Binance and OKX. The exfiltrated data includes full legal names, international phone numbers, dates of birth, and government identification numbers (Passports, National IDs). The breach is highly localized to Israeli users.

Context Behind the Israel Crypto Data Breach

In a recent broadcast distributed across underground Telegram channels, Disrupt0r published an Excel spreadsheet titled in Hebrew (“נספח לצת מעודכן.xlsx”), explicitly tagging the leak with the Israeli flag. This indicates a targeted geopolitical campaign rather than an opportunistic financial strike. Hacktivist groups operating against Israeli interests have increasingly pivoted toward financial sector data, recognizing that exposing verified cryptocurrency users yields high-value extortion material.

The actor claims the database represents a significant failure in the data protection protocols of leading global exchanges, specifically attributing 590+ records to Binance and 7+ records to OKX. While the total volume (600+ records) is comparatively small against global datasets, the density and quality of the exposed KYC documentation are exceptionally high.

Technical Analysis of the Exposed KYC Records

An analysis of the leaked spreadsheet preview confirms the exposure of deep relational PII (Personally Identifiable Information). The data structure includes registered email addresses, exact dates of birth, residential addresses extracted from ID documents, and account creation timestamps.

Cryptocurrency exchanges are legally mandated to collect extensive KYC documentation for Anti-Money Laundering (AML) compliance. The compromise of these specific centralized repositories provides malicious actors with a complete identity package (Fullz). The specific operational vector remains unverified. The data may have been breached directly from the exchanges’ internal compliance dashboards, a third-party KYC verification vendor (such as Onfido or Jumio), or through targeted phishing against high-net-worth users.

Impact Assessment: Identity and Financial Risk

The severity of this incident is classified as High. The combination of a user’s crypto exchange email, physical address, and government ID number creates an immediate risk for SIM swapping attacks and targeted spear-phishing.

Because the victims are known cryptocurrency investors, they face an elevated risk of targeted physical extortion (crypto-wrenching) or sophisticated digital fraud attempts designed to bypass multi-factor authentication (MFA) via total identity theft.

Mitigation & Prevention Strategies

Financial institutions and affected users must implement aggressive defensive postures to mitigate the fallout of this KYC exposure. We recommend the following actionable measures:

1. Authentication Audits: Affected users must immediately migrate SMS-based Two-Factor Authentication (2FA) to hardware security keys (e.g., YubiKey) or authenticator applications to neutralize SIM swapping risks.
2. Vendor Security Reviews: Cryptocurrency exchanges must mandate independent penetration testing for all third-party identity verification partners, enforcing strict data retention limits where KYC documents are purged post-verification.
3. Credential Rotation: Users should assume the exposed email addresses are actively being targeted. Migrate exchange accounts to unique, compartmentalized email addresses used strictly for financial transactions.
4. Fraud Monitoring: Israeli nationals affected by the breach should enable national credit monitoring services to detect unauthorized account creation using their compromised passport or ID numbers.

CyberAsia continues to monitor hacktivist operations targeting the financial sector. Read our latest Data Breach analysis for more updates on regional cyber incidents.

Reference: Israel National Cyber Directorate (INCD).

Mitigation & Prevention Strategies

Data breaches involving Personally Identifiable Information (PII) or sensitive corporate databases require immediate containment and long-term security overhauls:

• Database Hardening: Ensure databases (SQL, MongoDB, Elasticsearch) are never exposed directly to the public internet. Bind services to localhost or strict internal VPCs.
• Data Encryption: Implement robust encryption for data-at-rest. Even if threat actors exfiltrate database dumps, properly salted and hashed passwords minimize the blast radius.
• Credential Rotation: Following any suspected breach, force a global password reset for affected users and rotate API keys and service credentials immediately.

Disclaimer: CyberAsia is an independent Cyber Threat Intelligence (CTI) research organization. The information provided in this report is derived from public intelligence gathering, dark web monitoring, and threat actor claims. It is published strictly for educational purposes, defensive analysis, and public awareness. CyberAsia does not endorse, verify, or facilitate any cyberattacks or illegal activities.