Massive Crypto Breach: Over 18 Million US Crypto Users’ Data Listed for Sale on the Dark Web

Monicah W

Over 18 million US-based cryptocurrency users’ records are reportedly up for sale on the dark web, raising alarms about the security of personal data in the digital asset space. 

The database includes sensitive personal information sourced from more than 20 major cryptocurrency exchanges and platforms.

Dark Web Sale: Crypto Data for $10,000 Exposes Millions

Dark Web Informer reported the leak on April 15, sparking concerns regarding the security of cryptocurrency users in the US.

“A threat actor is allegedly selling a large US-based cryptocurrency user database, sourced from multiple exchanges and platforms,” the post read.

For just $10,000, buyers can access detailed information, including full names, email addresses, phone numbers, and physical addresses. The data, sourced from prominent platforms, could potentially expose millions of users to identity theft and other cybercrimes.

The leaked data reportedly includes around 1.5 million Binance US phone records and 79,743 full records. In addition, 1.8 million records were from Crypto.com, 432,000 from Coinbase, 197,000 from Robinhood, 121,071 from Kraken, 800,000 from Gemini, and 76,710 from CoinMarketCap.

“We want to clarify that there has been no data leak from Binance’s systems. Our security team has been actively monitoring a known hacker on the Dark Web who collects data by compromising browser sessions on infected computers,” Binance told BeInCrypto through an email.

Dark Web Informer shared a screenshot of the alleged sale listing, which also highlighted additional records from Ledger, Bitfinex, Coinmama, BearTax, USA Crypto Legacy, and others. The total dataset spans over 18 million lines of user information.

Dark Web Sale of Cryptocurrency User Data
Dark Web Sale of Cryptocurrency User Data. Source: DarkWebInformer

This report follows another alarming disclosure by Dark Web Informer. The analyst revealed that a separate threat actor was selling crypto investor leads tied to Robinhood accounts across the US and Europe.

The affected countries included the Netherlands, Switzerland, France, Germany, Poland, Spain, and the UK. The listing featured data that was not publicly scraped, suggesting that the information was obtained through unauthorized access or breaches. 

Robinhood Crypto Data For Sale on Dark Web
Robinhood Crypto Data For Sale on Dark Web. Source: DarkWebInformer

This is not the first time such warnings have surfaced. BeInCrypto previously reported that someone was selling the crypto user database from Ledger, Gemini, and Robinhood. Similarly, last month, the news emerged that over 230,000 combined user records from Binance and Gemini had reportedly been listed for sale on the dark web.

The continuous exposure of crypto users’ personal data stresses the urgent need for heightened security measures within the industry. Investors should enable two-factor authentication, use unique passwords, and remain vigilant against unsolicited communications that may attempt to harvest credentials.

The post Massive Crypto Breach: Over 18 Million US Crypto Users’ Data Listed for Sale on the Dark Web appeared first on BeInCrypto.

Related Posts

Malicious Actors are Targeting Atomic and Exodus Wallet Users

Cybercriminals have found a new attack vector, targeting users of Atomic and Exodus wallets through open-source software repositories.

The latest wave of exploits involves distributing malware-laced packages to compromise private keys and drain digital assets.

How Hackers are Targeting Atomic and Exodus Wallets

ReversingLabs, a cybersecurity firm, has uncovered a malicious campaign where attackers compromised Node Package Manager (NPM) libraries.

These libraries, often disguised as legitimate tools like PDF-to-Office converters, carry hidden malware. Once installed, the malicious code executes a multi-phase attack.

First, the software scans the infected device for crypto wallets. Then, it injects harmful code into the system. This includes a clipboard hijacker that silently alters wallet addresses during transactions, rerouting funds to wallets controlled by the attackers.

Malicious Code Targeting Atomic and Exodus Wallets.
Malicious Code Targeting Atomic and Exodus Wallets. Source: ReversingLabs

Moreover, the malware also collects system details and monitors how successfully it infiltrated each target. This intelligence allows threat actors to improve their methods and scale future attacks more effectively.

Meanwhile, ReversingLabs also noted that the malware maintains persistence. Even if the deceptive package, such as pdf-to-office, is deleted, remnants of the malicious code remain active.

To fully cleanse a system, users must uninstall affected crypto wallet software and reinstall from verified sources.

Indeed, security experts noted that the scope of the threat highlights the growing software supply chain risks threatening the industry.

“The frequency and sophistication of software supply chain attacks that target the cryptocurrency industry are also a warning sign of what’s to come in other industries. And they’re more evidence of the need for organizations to improve their ability to monitor for software supply chain threats and attacks,” ReversingLabs stated.

This week, Kaspersky researchers reported a parallel campaign using SourceForge, where cybercriminals uploaded fake Microsoft Office installers embedded with malware.

These infected files included clipboard hijackers and crypto miners, posing as legitimate software but operating silently in the background to compromise wallets.

The incidents highlight a surge in open-source abuse and present a disturbing trend of attackers increasingly hiding malware inside software packages developers trust.

Considering the prominence of these attacks, crypto users and developers are urged to remain vigilant, verify software sources, and implement strong security practices to mitigate growing threats.

According to DeFiLlama, over $1.5 billion in crypto assets were lost to exploits in Q1 2025 alone. The largest incident involved a $1.4 billion Bybit breach in February.

The post Malicious Actors are Targeting Atomic and Exodus Wallet Users appeared first on BeInCrypto.