Rewterz Threat Update – Iran’s Crypto Exchange Accidentally Exposed User IDs, Credit Cards, and Passports

Severity

High

Analysis Summary

Researchers revealed that Iranian crypto exchange Bit24.cash had accidentally leaked sensitive data of about 230,000 users, including user IDs, credit cards, and passports. This occurred due to a misconfigured MinIO instance, a high-performance object storage system.

Iran has limited access to foreign financial markets, making it embrace cryptocurrency significantly. During the last year, crypto exchanges in Iran had a total of almost $3 billion worth of transactions. Most of the incoming cryptocurrency in Iran adheres to the Know Your Customer (KYC) procedure. Bit24.cash is Iran’s over-the-counter crypto exchange that supports more than 300 coins and tokens, making it exceptional. During its KYC process, users must confirm their identity by uploading official documents. Users expect organizations to protect these documents as they are sensitive.

However, due to a misconfigured MinIO instance, the company unknowingly granted access to S3 buckets, which are cloud storage containers, that contained the platform’s KYC data. This resulted in compromising almost 230,000 Iranian citizens and exposing their written consent to regulations, credit cards, passports, and IDs. The company has not issued any response on the incident but the affected instance has been secured and is no longer accessible.

The compromised KYC verification data is very critical for cryptocurrency exchange platforms and the breach poses a severe threat because malicious actors can exploit the exposed data to commit fraudulent transactions, identity theft, and phishing attacks. The attackers can also use the leaked personal and financial data to gain unauthorized access to accounts and potentially cause financial and personal harm to the impacted users.

Impact

• Unauthorized Access
• Financial Loss
• Exposure to Sensitive Data
• Identity Theft

Remediation

• Cryptocurrency companies should bolster their overall security posture by implementing advanced security measures, including multi-factor authentication (MFA), strong access controls, and encryption.
• Conduct regular security audits and vulnerability assessments to identify and remediate potential weaknesses within cryptocurrency platforms and wallets.
• Educate users about security best practices, including how to recognize phishing attempts, safeguard private keys, and enable strong authentication methods.
• Perform red team exercises to simulate attacks and identify vulnerabilities.
• Deploy advanced threat detection tools that monitor for anomalous activities and unauthorized access attempts on cryptocurrency platforms.
• Implement network segmentation to contain and isolate potential threats to limit their impact on critical systems.
• Never trust or open links and attachments received from unknown sources/senders.