Darkweb actors say they have over 100,000 Binance and Gemini users’ details

Darkweb threat actors claim to have the details for more than 100,000 users of tier-1 crypto exchange platforms Binance and Gemini. 

The Dark Web Informer, a cyber news site for the shady side of the internet, said in a blog post yesterday that a dark web user under the handle AKM69 is selling Gemini user information. The details on offer include names, passwords, and even location data.

“The database for sale reportedly includes 100,000 records, each containing full names, emails, phone numbers, and location data of individuals from the United States and a few entries from Singapore and the UK,” the news site wrote in its post.

The user also categorized the listing as part of a larger campaign of selling consumer data for “crypto-related marketing, fraud, or recovery targeting,” it added.

User data stolen through compromised tech, not a Binance leak

Dark Web Infromer’s recent post comes just a day after the news site warned that another user with the handle kiki88888 was selling Binance emails and passwords. The compromised data, in this instance, reportedly contained 132,744 lines of information.

According to Dark Web Informer, the stolen data was retrieved through users’ technology, which had been compromised and was not a result of a data leak from the largest crypto exchange by daily trading volume. 

The news site went on to warn that people “really need to stop clicking random stuff.” 

Some of you really need to stop clicking random stuff. Data courtesy of @whiteintel_io pic.twitter.com/MmbqYnFPVy

— Dark Web Informer (@DarkWebInformer) March 26, 2025

A snapshot of the data shared by Dark Web Informer on X shows that 500,968 devices had been compromised. In the stolen data on sale were 24 corporate emails.

Binance has had its fair share of cyber threats. Last September, another darkweb user claimed to have a massive database of Binance user details that was 12.8 million records large. However, Binance went on to deny the hacker’s claims following an internal investigation by the company’s security team.

Australia is also combating cyber threats this month

The recent Binance and Gemini incidents are not the only cyber threats targeting crypto exchange users this month. On March 21, Australian federal police had to alert 130 people of a message scam that was circulating and targeting crypto exchange users specifically. The messages spoofed the same “sender ID” as legitimate exchange platforms, including Binance.

Just a week prior to that, on March 14, a string of scam messages that spoofed Coinbase and Gemini were flagged by X users. The messages would try to trick receivers into setting up a new wallet using pre-generated recovery phrases controlled by cybercriminals. After sending crypto to these new wallets, users would lose access to their digital asset holdings.