Dark Web Hackers Claim to Have Data of Over 100,000 Gemini and Binance Users

Highlights:

• Hacker AKM69 is selling 100,000 records from Binance and Gemini users.
• Dark Web Informer warns compromised devices, not Binance, may be the cause.
• Crypto-related cyber threats and scams are rising, targeting exchanges and users.

The Dark Web Informer, a cyber news site on the dark web, reported in a March 27 blog post that a hacker named AKM69 is selling a large list of private user data from major crypto exchanges Gemini and Binance. The database for sale reportedly contains 100,000 records with full names, emails, and phone numbers. It includes U.S. individuals, plus some from Singapore and the UK.

The hacker claims that the listing is part of a larger campaign. It aims to sell consumer data for crypto marketing, fraud, and recovery scams.

Alleged Sale of 100K U.S. Gemini Cryptocurrency User Leadshttps://t.co/svdZIL6TO4

— Dark Web Informer – Cyber Threat Intelligence (@DarkWebInformer) March 27, 2025

A day earlier, a threat actor named “kiki88888” reportedly listed another set of Binance user data, including emails and passwords. This batch allegedly contains over 132,000 records, though the data’s source remains unclear.​

Some of you really need to stop clicking random stuff. Data courtesy of @whiteintel_io pic.twitter.com/MmbqYnFPVy

— Dark Web Informer – Cyber Threat Intelligence (@DarkWebInformer) March 26, 2025

Hacked Devices Likely Behind the Breach

Dark Web Informer hinted that hacked user devices, not a Binance breach, might be the cause and warned users to avoid clicking suspicious links. In September, a hacker called “FireBear” claimed to have stolen over 12 million records from Binance, including personal details like birthdates and addresses. After an internal investigation, Binance denied those claims, stating that no sensitive user data was compromised. 

This month has witnessed a surge in cyber threats against crypto users. On March 21, the Australian Federal Police warned 130 people about a scam that faked crypto exchange sender IDs, including Binance. On March 14, users on X reported scam messages posing as Coinbase and Gemini. The scammers tricked victims into using wallets with pre-generated recovery phrases.

These incidents extend beyond crypto exchanges. In December, hackers breached Byte Federal, exposing the personal data of over 58,000 customers. A month later, SlowMist warned that more than 7 million OpenSea user emails had been fully exposed. Originally compromised in a June 2022 breach, this put users at risk of phishing attacks.

Is anyone else getting the fake @coinbase emails and texts? They’re getting increasingly sophisticated.

One is a fake verification text to get you to call a fake support number and the other is an email getting you to set up a real wallet they can drain.

Stay safe out there. pic.twitter.com/8SgjPQeUqk

— Steve (@SteveKBark) March 14, 2025

Rising Cyber Threats in the Crypto Space

Microsoft found a new malware called StilachiRAT that sneaks into Chrome wallet extensions to steal crypto users’ sensitive data. This comes as cyberattacks on digital assets are increasing. Microsoft urged crypto users to enhance security with antivirus software, anti-phishing tools, and strong malware protection. This comes as malware attacks and crypto fraud continue to rise. 

In February, losses in the crypto ecosystem surged 20x from January, reaching $1.53 billion due to nine hacks, according to Immunefi. This marks a sharp rise from January’s $73.9 million and an 18x increase from last February’s $81.6 million.

Crypto leaks aren’t the only issue in the industry. The U.S. Justice Department recently seized over $200,000 in cryptocurrency allegedly linked to Hamas. On March 27, the DOJ stated that the $201,400 was tied to fundraising addresses controlled by Hamas. These addresses reportedly laundered over $1.5 million in digital assets since October last year.