Posts: 1
Threads: 0
Joined: Apr 2026
(Feb 03, 2026, 05:00 PM)thelastwhitehat Wrote:
Description:
In August 2023, Kroll (kroll.com), a financial advisory firm renowned for assisting large companies facing bankruptcy, was the victim of a data breach that affected creditors of FTX, BlockFi, and Genesis. The breach occurred when threat actors targeted a Kroll employee's T-Mobile US account through a SIM swap attack. Notably, T-Mobile, without any authorization from or communication with Kroll or its employee, transferred the employee's phone number to the threat actor's device upon request. With control of the phone number, the threat actors bypassed internal safeguards and accessed sensitive files and documents containing personal information related to the bankruptcy claimants of BlockFi, FTX, and Genesis. The stolen data included full names, email addresses, KYC statuses, and internal notes (such as account balances and risk assessments).
According to well-known cryptocurrency theft investigator ZachXBT, as of December 5, 2025, this breach has led to over $300 million being stolen from the affected individuals through spear phishing campaigns orchestrated by the threat actors.
Please do not contact me about purchasing the entire data set or documents.
Samples:
Spoiler Spoiler
"applicantId","externalId","creationDate","lastReviewDate","applicantName","applicantEmail","applicantPhoneNumber","applicantCountry","rejectType","rejectLabels","customTags","sourceKey","result","applicantLevel","platform","status","userComment","clientComment"
"000a3cac49bf5ac27ae68c7c","134815","2021-12-09 10:48:54","2022-02-13 10:48:54","","[email protected]","","","","","[Over 1000 balance, HIGH-TRANSACTION VOLUME]","ftxcom","GREEN","level ques2_AML","","completed","",""
"000ae08ee74fa544ea3cda0a","user|[email protected]","2021-07-03 10:14:42","2021-09-06 10:14:42","","[email protected]","","USA","RETRY","[COMPANY_NOT_VALIDATED_BENEFICIARIES]","[Over 10000 balance, HIGH-FREQUENCY TRADING]","blockfolio-ftxus","RED","level ques2_AML","Web","completed","",""
"000c9233a194edd85e04ca2e","76989","2023-01-30 05:47:20","2023-02-15 05:47:20","","[email protected]","","USA","","","[Compliance documentation]","ftxcom","GREEN","level ques1_AML","","completed","",""
"000ca51d8e6cc6ff1e1a1f3c","275523","2022-10-30 08:38:21","2023-01-05 08:38:21","ROBIN LOWEY","[email protected]","","","","","[Account recovery requested]","ftxcom","GREEN","level ques1_AML","","completed","",""
"000d97e8b87b6d059f76fa22","320671","2022-06-14 14:31:52","2022-09-12 14:31:52","","[email protected]","","","","","","ftxcom","GREEN","level ques2_AML","Web","completed","",""
"000de6af56ecbc0c0d73fcb2","user|[email protected]","2023-07-25 14:28:35","2023-08-31 00:00:00","","[email protected]","","USA","","","","ftxus","GREEN","level ques3_AML","","completed","",""
"000ecd3bd57be10a23d2df3c","435209","2022-01-16 04:53:40","2022-03-07 04:53:40","KEITH SAMUEL","[email protected]","","","","","","ftxcom","GREEN","level ques2_AML","","completed","",""
"00a0eb9dffb2a7de37aff5e6","user|[email protected]","2023-04-09 20:10:32","2023-04-20 20:10:32","","[email protected]","","USA","","","[HIGH-TRANSACTION VOLUME]","ftxus","GREEN","level ques1_KYC","","completed","",""
"00a2b4fdfd67a88eb3b6dc56","","2021-11-02 15:31:58","2021-11-27 15:31:58","","[email protected]","","USA","","","","ftxus","GREEN","level ques2_AML","Web","completed","",""
"00a3d65dcbb316b3289fea5c","395615","2022-11-21 05:58:10","2023-01-04 05:58:10","","[email protected]","","USA","","","","ftxcom","GREEN","level ques2_AML","Web","completed","",""
"00a3de0d1f96a8fde43caa4a","user|[email protected]","2020-08-13 00:31:47","2020-10-04 00:31:47","","[email protected]","","USA","","","","ftxus","GREEN","level ques1_AML","","completed","",""
"00a4aab3d363a4fab8fd062a","109170","2020-09-07 04:56:27","2020-09-23 04:56:27","","[email protected]","","USA","","","[KYC incomplete, Manual approve, Manual review: High Risk Jurisdiction, Over 1000 balance, Unusual IP detection]","ftxcom","RED","level highrisk_AML","Web","completed","",""
"00a4ddcb9c9eb8a2c4c319a8","32437","2021-03-27 22:04:32","2021-05-19 22:04:32","","[email protected]","","USA","","","[Over 10000 balance]","ftxcom","GREEN","level ques1_KYC","Web","completed","",""
"00a4eeb03d1d8a6cc1bed0ff","7892c709-74d2-4eb6-856c-7efb92a4156d","2022-02-12 09:03:09","2022-05-06 09:03:09","","[email protected]","","","","","","ftxjp","GREEN","level ques3_AML","","completed","",""
Downloads:
thx This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Contact Administration.
Posts: 1
Threads: 0
Joined: Apr 2026
good work man, amazing This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Contact Administration.
Posts: 421
Threads: 14
Joined: Aug 2023
thanks for sharing it, sucks you cant trust your own private circle.
Posts: 2
Threads: 0
Joined: Apr 2026
great share man This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Contact Administration.
Posts: 19
Threads: 0
Joined: Jul 2023
great ,thanks for sharing.
Posts: 37
Threads: 1
Joined: Jan 2024
Great crypto leak addition
Posts: 29
Threads: 0
Joined: Apr 2026
great share u gold bro ngl cant wait for next This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Contact Administration.
Posts: 23
Threads: 2
Joined: May 2024
Well done .. ty for sharing.
Posts: 118
Threads: 7
Joined: Jan 2025
(Feb 03, 2026, 05:00 PM)thelastwhitehat Wrote:
Description:
In August 2023, Kroll (kroll.com), a financial advisory firm renowned for assisting large companies facing bankruptcy, was the victim of a data breach that affected creditors of FTX, BlockFi, and Genesis. The breach occurred when threat actors targeted a Kroll employee's T-Mobile US account through a SIM swap attack. Notably, T-Mobile, without any authorization from or communication with Kroll or its employee, transferred the employee's phone number to the threat actor's device upon request. With control of the phone number, the threat actors bypassed internal safeguards and accessed sensitive files and documents containing personal information related to the bankruptcy claimants of BlockFi, FTX, and Genesis. The stolen data included full names, email addresses, KYC statuses, and internal notes (such as account balances and risk assessments).
According to well-known cryptocurrency theft investigator ZachXBT, as of December 5, 2025, this breach has led to over $300 million being stolen from the affected individuals through spear phishing campaigns orchestrated by the threat actors.
Please do not contact me about purchasing the entire data set or documents.
Samples:
Spoiler Spoiler
"applicantId","externalId","creationDate","lastReviewDate","applicantName","applicantEmail","applicantPhoneNumber","applicantCountry","rejectType","rejectLabels","customTags","sourceKey","result","applicantLevel","platform","status","userComment","clientComment"
"000a3cac49bf5ac27ae68c7c","134815","2021-12-09 10:48:54","2022-02-13 10:48:54","","[email protected]","","","","","[Over 1000 balance, HIGH-TRANSACTION VOLUME]","ftxcom","GREEN","level ques2_AML","","completed","",""
"000ae08ee74fa544ea3cda0a","user|[email protected]","2021-07-03 10:14:42","2021-09-06 10:14:42","","[email protected]","","USA","RETRY","[COMPANY_NOT_VALIDATED_BENEFICIARIES]","[Over 10000 balance, HIGH-FREQUENCY TRADING]","blockfolio-ftxus","RED","level ques2_AML","Web","completed","",""
"000c9233a194edd85e04ca2e","76989","2023-01-30 05:47:20","2023-02-15 05:47:20","","[email protected]","","USA","","","[Compliance documentation]","ftxcom","GREEN","level ques1_AML","","completed","",""
"000ca51d8e6cc6ff1e1a1f3c","275523","2022-10-30 08:38:21","2023-01-05 08:38:21","ROBIN LOWEY","[email protected]","","","","","[Account recovery requested]","ftxcom","GREEN","level ques1_AML","","completed","",""
"000d97e8b87b6d059f76fa22","320671","2022-06-14 14:31:52","2022-09-12 14:31:52","","[email protected]","","","","","","ftxcom","GREEN","level ques2_AML","Web","completed","",""
"000de6af56ecbc0c0d73fcb2","user|[email protected]","2023-07-25 14:28:35","2023-08-31 00:00:00","","[email protected]","","USA","","","","ftxus","GREEN","level ques3_AML","","completed","",""
"000ecd3bd57be10a23d2df3c","435209","2022-01-16 04:53:40","2022-03-07 04:53:40","KEITH SAMUEL","[email protected]","","","","","","ftxcom","GREEN","level ques2_AML","","completed","",""
"00a0eb9dffb2a7de37aff5e6","user|[email protected]","2023-04-09 20:10:32","2023-04-20 20:10:32","","[email protected]","","USA","","","[HIGH-TRANSACTION VOLUME]","ftxus","GREEN","level ques1_KYC","","completed","",""
"00a2b4fdfd67a88eb3b6dc56","","2021-11-02 15:31:58","2021-11-27 15:31:58","","[email protected]","","USA","","","","ftxus","GREEN","level ques2_AML","Web","completed","",""
"00a3d65dcbb316b3289fea5c","395615","2022-11-21 05:58:10","2023-01-04 05:58:10","","[email protected]","","USA","","","","ftxcom","GREEN","level ques2_AML","Web","completed","",""
"00a3de0d1f96a8fde43caa4a","user|[email protected]","2020-08-13 00:31:47","2020-10-04 00:31:47","","[email protected]","","USA","","","","ftxus","GREEN","level ques1_AML","","completed","",""
"00a4aab3d363a4fab8fd062a","109170","2020-09-07 04:56:27","2020-09-23 04:56:27","","[email protected]","","USA","","","[KYC incomplete, Manual approve, Manual review: High Risk Jurisdiction, Over 1000 balance, Unusual IP detection]","ftxcom","RED","level highrisk_AML","Web","completed","",""
"00a4ddcb9c9eb8a2c4c319a8","32437","2021-03-27 22:04:32","2021-05-19 22:04:32","","[email protected]","","USA","","","[Over 10000 balance]","ftxcom","GREEN","level ques1_KYC","Web","completed","",""
"00a4eeb03d1d8a6cc1bed0ff","7892c709-74d2-4eb6-856c-7efb92a4156d","2022-02-12 09:03:09","2022-05-06 09:03:09","","[email protected]","","","","","","ftxjp","GREEN","level ques3_AML","","completed","",""
Downloads:
thanks for the leak
Posts: 97
Threads: 46
Joined: Nov 2023
(Feb 03, 2026, 05:00 PM)thelastwhitehat Wrote:
Description:
In August 2023, Kroll (kroll.com), a financial advisory firm renowned for assisting large companies facing bankruptcy, was the victim of a data breach that affected creditors of FTX, BlockFi, and Genesis. The breach occurred when threat actors targeted a Kroll employee's T-Mobile US account through a SIM swap attack. Notably, T-Mobile, without any authorization from or communication with Kroll or its employee, transferred the employee's phone number to the threat actor's device upon request. With control of the phone number, the threat actors bypassed internal safeguards and accessed sensitive files and documents containing personal information related to the bankruptcy claimants of BlockFi, FTX, and Genesis. The stolen data included full names, email addresses, KYC statuses, and internal notes (such as account balances and risk assessments).
According to well-known cryptocurrency theft investigator ZachXBT, as of December 5, 2025, this breach has led to over $300 million being stolen from the affected individuals through spear phishing campaigns orchestrated by the threat actors.
Please do not contact me about purchasing the entire data set or documents.
Samples:
Spoiler Spoiler
"applicantId","externalId","creationDate","lastReviewDate","applicantName","applicantEmail","applicantPhoneNumber","applicantCountry","rejectType","rejectLabels","customTags","sourceKey","result","applicantLevel","platform","status","userComment","clientComment"
"000a3cac49bf5ac27ae68c7c","134815","2021-12-09 10:48:54","2022-02-13 10:48:54","","[email protected]","","","","","[Over 1000 balance, HIGH-TRANSACTION VOLUME]","ftxcom","GREEN","level ques2_AML","","completed","",""
"000ae08ee74fa544ea3cda0a","user|[email protected]","2021-07-03 10:14:42","2021-09-06 10:14:42","","[email protected]","","USA","RETRY","[COMPANY_NOT_VALIDATED_BENEFICIARIES]","[Over 10000 balance, HIGH-FREQUENCY TRADING]","blockfolio-ftxus","RED","level ques2_AML","Web","completed","",""
"000c9233a194edd85e04ca2e","76989","2023-01-30 05:47:20","2023-02-15 05:47:20","","[email protected]","","USA","","","[Compliance documentation]","ftxcom","GREEN","level ques1_AML","","completed","",""
"000ca51d8e6cc6ff1e1a1f3c","275523","2022-10-30 08:38:21","2023-01-05 08:38:21","ROBIN LOWEY","[email protected]","","","","","[Account recovery requested]","ftxcom","GREEN","level ques1_AML","","completed","",""
"000d97e8b87b6d059f76fa22","320671","2022-06-14 14:31:52","2022-09-12 14:31:52","","[email protected]","","","","","","ftxcom","GREEN","level ques2_AML","Web","completed","",""
"000de6af56ecbc0c0d73fcb2","user|[email protected]","2023-07-25 14:28:35","2023-08-31 00:00:00","","[email protected]","","USA","","","","ftxus","GREEN","level ques3_AML","","completed","",""
"000ecd3bd57be10a23d2df3c","435209","2022-01-16 04:53:40","2022-03-07 04:53:40","KEITH SAMUEL","[email protected]","","","","","","ftxcom","GREEN","level ques2_AML","","completed","",""
"00a0eb9dffb2a7de37aff5e6","user|[email protected]","2023-04-09 20:10:32","2023-04-20 20:10:32","","[email protected]","","USA","","","[HIGH-TRANSACTION VOLUME]","ftxus","GREEN","level ques1_KYC","","completed","",""
"00a2b4fdfd67a88eb3b6dc56","","2021-11-02 15:31:58","2021-11-27 15:31:58","","[email protected]","","USA","","","","ftxus","GREEN","level ques2_AML","Web","completed","",""
"00a3d65dcbb316b3289fea5c","395615","2022-11-21 05:58:10","2023-01-04 05:58:10","","[email protected]","","USA","","","","ftxcom","GREEN","level ques2_AML","Web","completed","",""
"00a3de0d1f96a8fde43caa4a","user|[email protected]","2020-08-13 00:31:47","2020-10-04 00:31:47","","[email protected]","","USA","","","","ftxus","GREEN","level ques1_AML","","completed","",""
"00a4aab3d363a4fab8fd062a","109170","2020-09-07 04:56:27","2020-09-23 04:56:27","","[email protected]","","USA","","","[KYC incomplete, Manual approve, Manual review: High Risk Jurisdiction, Over 1000 balance, Unusual IP detection]","ftxcom","RED","level highrisk_AML","Web","completed","",""
"00a4ddcb9c9eb8a2c4c319a8","32437","2021-03-27 22:04:32","2021-05-19 22:04:32","","[email protected]","","USA","","","[Over 10000 balance]","ftxcom","GREEN","level ques1_KYC","Web","completed","",""
"00a4eeb03d1d8a6cc1bed0ff","7892c709-74d2-4eb6-856c-7efb92a4156d","2022-02-12 09:03:09","2022-05-06 09:03:09","","[email protected]","","","","","","ftxjp","GREEN","level ques3_AML","","completed","",""
Downloads: thanks for sharing
|
![[Image: Kroll_Logo_2021.png]](https://bf.st/img/3a5184a8e5aa49733b7da580a91bfd1f30b51b31/68747470733a2f2f65787465726e616c2d636f6e74656e742e6475636b6475636b676f2e636f6d2f69752f3f753d68747470733a2f2f75706c6f61642e77696b696d656469612e6f72672f77696b6970656469612f636f6d6d6f6e732f302f30362f4b726f6c6c5f4c6f676f5f323032312e706e67)
