Posts: 93
Threads: 37
Joined: Apr 2026
Feb 03, 2026, 05:00 PM
(This post was last modified: Feb 03, 2026, 05:01 PM by thelushen1.)
Description:
In August 2023, Kroll ( kroll.com), a financial advisory firm renowned for assisting large companies facing bankruptcy, was the victim of a data breach that affected creditors of FTX, BlockFi, and Genesis. The breach occurred when threat actors targeted a Kroll employee's T-Mobile US account through a SIM swap attack. Notably, T-Mobile, without any authorization from or communication with Kroll or its employee, transferred the employee's phone number to the threat actor's device upon request. With control of the phone number, the threat actors bypassed internal safeguards and accessed sensitive files and documents containing personal information related to the bankruptcy claimants of BlockFi, FTX, and Genesis. The stolen data included full names, email addresses, KYC statuses, and internal notes (such as account balances and risk assessments).
According to well-known cryptocurrency theft investigator ZachXBT, as of December 5, 2025, this breach has led to over $300 million being stolen from the affected individuals through spear phishing campaigns orchestrated by the threat actors.
Please do not contact me about purchasing the entire data set or documents.
Samples:
Spoiler Spoiler
"applicantId","externalId","creationDate","lastReviewDate","applicantName","applicantEmail","applicantPhoneNumber","applicantCountry","rejectType","rejectLabels","customTags","sourceKey","result","applicantLevel","platform","status","userComment","clientComment"
"000a3cac49bf5ac27ae68c7c","134815","2021-12-09 10:48:54","2022-02-13 10:48:54","","[email protected]","","","","","[Over 1000 balance, HIGH-TRANSACTION VOLUME]","ftxcom","GREEN","level ques2_AML","","completed","",""
"000ae08ee74fa544ea3cda0a","user|[email protected]","2021-07-03 10:14:42","2021-09-06 10:14:42","","[email protected]","","USA","RETRY","[COMPANY_NOT_VALIDATED_BENEFICIARIES]","[Over 10000 balance, HIGH-FREQUENCY TRADING]","blockfolio-ftxus","RED","level ques2_AML","Web","completed","",""
"000c9233a194edd85e04ca2e","76989","2023-01-30 05:47:20","2023-02-15 05:47:20","","[email protected]","","USA","","","[Compliance documentation]","ftxcom","GREEN","level ques1_AML","","completed","",""
"000ca51d8e6cc6ff1e1a1f3c","275523","2022-10-30 08:38:21","2023-01-05 08:38:21","ROBIN LOWEY","[email protected]","","","","","[Account recovery requested]","ftxcom","GREEN","level ques1_AML","","completed","",""
"000d97e8b87b6d059f76fa22","320671","2022-06-14 14:31:52","2022-09-12 14:31:52","","[email protected]","","","","","","ftxcom","GREEN","level ques2_AML","Web","completed","",""
"000de6af56ecbc0c0d73fcb2","user|[email protected]","2023-07-25 14:28:35","2023-08-31 00:00:00","","[email protected]","","USA","","","","ftxus","GREEN","level ques3_AML","","completed","",""
"000ecd3bd57be10a23d2df3c","435209","2022-01-16 04:53:40","2022-03-07 04:53:40","KEITH SAMUEL","[email protected]","","","","","","ftxcom","GREEN","level ques2_AML","","completed","",""
"00a0eb9dffb2a7de37aff5e6","user|[email protected]","2023-04-09 20:10:32","2023-04-20 20:10:32","","[email protected]","","USA","","","[HIGH-TRANSACTION VOLUME]","ftxus","GREEN","level ques1_KYC","","completed","",""
"00a2b4fdfd67a88eb3b6dc56","","2021-11-02 15:31:58","2021-11-27 15:31:58","","[email protected]","","USA","","","","ftxus","GREEN","level ques2_AML","Web","completed","",""
"00a3d65dcbb316b3289fea5c","395615","2022-11-21 05:58:10","2023-01-04 05:58:10","","[email protected]","","USA","","","","ftxcom","GREEN","level ques2_AML","Web","completed","",""
"00a3de0d1f96a8fde43caa4a","user|[email protected]","2020-08-13 00:31:47","2020-10-04 00:31:47","","[email protected]","","USA","","","","ftxus","GREEN","level ques1_AML","","completed","",""
"00a4aab3d363a4fab8fd062a","109170","2020-09-07 04:56:27","2020-09-23 04:56:27","","[email protected]","","USA","","","[KYC incomplete, Manual approve, Manual review: High Risk Jurisdiction, Over 1000 balance, Unusual IP detection]","ftxcom","RED","level highrisk_AML","Web","completed","",""
"00a4ddcb9c9eb8a2c4c319a8","32437","2021-03-27 22:04:32","2021-05-19 22:04:32","","[email protected]","","USA","","","[Over 10000 balance]","ftxcom","GREEN","level ques1_KYC","Web","completed","",""
"00a4eeb03d1d8a6cc1bed0ff","7892c709-74d2-4eb6-856c-7efb92a4156d","2022-02-12 09:03:09","2022-05-06 09:03:09","","[email protected]","","","","","","ftxjp","GREEN","level ques3_AML","","completed","",""
Downloads:
This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Contact Administration.
Posts: 28
Threads: 0
Joined: Apr 2026
great share!! thank u sm This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Contact Administration.
Posts: 161
Threads: 1
Joined: Mar 2025
(Feb 03, 2026, 05:00 PM)thelastwhitehat Wrote:
Description:
In August 2023, Kroll (kroll.com), a financial advisory firm renowned for assisting large companies facing bankruptcy, was the victim of a data breach that affected creditors of FTX, BlockFi, and Genesis. The breach occurred when threat actors targeted a Kroll employee's T-Mobile US account through a SIM swap attack. Notably, T-Mobile, without any authorization from or communication with Kroll or its employee, transferred the employee's phone number to the threat actor's device upon request. With control of the phone number, the threat actors bypassed internal safeguards and accessed sensitive files and documents containing personal information related to the bankruptcy claimants of BlockFi, FTX, and Genesis. The stolen data included full names, email addresses, KYC statuses, and internal notes (such as account balances and risk assessments).
According to well-known cryptocurrency theft investigator ZachXBT, as of December 5, 2025, this breach has led to over $300 million being stolen from the affected individuals through spear phishing campaigns orchestrated by the threat actors.
Please do not contact me about purchasing the entire data set or documents.
Samples:
Spoiler Spoiler
"applicantId","externalId","creationDate","lastReviewDate","applicantName","applicantEmail","applicantPhoneNumber","applicantCountry","rejectType","rejectLabels","customTags","sourceKey","result","applicantLevel","platform","status","userComment","clientComment"
"000a3cac49bf5ac27ae68c7c","134815","2021-12-09 10:48:54","2022-02-13 10:48:54","","[email protected]","","","","","[Over 1000 balance, HIGH-TRANSACTION VOLUME]","ftxcom","GREEN","level ques2_AML","","completed","",""
"000ae08ee74fa544ea3cda0a","user|[email protected]","2021-07-03 10:14:42","2021-09-06 10:14:42","","[email protected]","","USA","RETRY","[COMPANY_NOT_VALIDATED_BENEFICIARIES]","[Over 10000 balance, HIGH-FREQUENCY TRADING]","blockfolio-ftxus","RED","level ques2_AML","Web","completed","",""
"000c9233a194edd85e04ca2e","76989","2023-01-30 05:47:20","2023-02-15 05:47:20","","[email protected]","","USA","","","[Compliance documentation]","ftxcom","GREEN","level ques1_AML","","completed","",""
"000ca51d8e6cc6ff1e1a1f3c","275523","2022-10-30 08:38:21","2023-01-05 08:38:21","ROBIN LOWEY","[email protected]","","","","","[Account recovery requested]","ftxcom","GREEN","level ques1_AML","","completed","",""
"000d97e8b87b6d059f76fa22","320671","2022-06-14 14:31:52","2022-09-12 14:31:52","","[email protected]","","","","","","ftxcom","GREEN","level ques2_AML","Web","completed","",""
"000de6af56ecbc0c0d73fcb2","user|[email protected]","2023-07-25 14:28:35","2023-08-31 00:00:00","","[email protected]","","USA","","","","ftxus","GREEN","level ques3_AML","","completed","",""
"000ecd3bd57be10a23d2df3c","435209","2022-01-16 04:53:40","2022-03-07 04:53:40","KEITH SAMUEL","[email protected]","","","","","","ftxcom","GREEN","level ques2_AML","","completed","",""
"00a0eb9dffb2a7de37aff5e6","user|[email protected]","2023-04-09 20:10:32","2023-04-20 20:10:32","","[email protected]","","USA","","","[HIGH-TRANSACTION VOLUME]","ftxus","GREEN","level ques1_KYC","","completed","",""
"00a2b4fdfd67a88eb3b6dc56","","2021-11-02 15:31:58","2021-11-27 15:31:58","","[email protected]","","USA","","","","ftxus","GREEN","level ques2_AML","Web","completed","",""
"00a3d65dcbb316b3289fea5c","395615","2022-11-21 05:58:10","2023-01-04 05:58:10","","[email protected]","","USA","","","","ftxcom","GREEN","level ques2_AML","Web","completed","",""
"00a3de0d1f96a8fde43caa4a","user|[email protected]","2020-08-13 00:31:47","2020-10-04 00:31:47","","[email protected]","","USA","","","","ftxus","GREEN","level ques1_AML","","completed","",""
"00a4aab3d363a4fab8fd062a","109170","2020-09-07 04:56:27","2020-09-23 04:56:27","","[email protected]","","USA","","","[KYC incomplete, Manual approve, Manual review: High Risk Jurisdiction, Over 1000 balance, Unusual IP detection]","ftxcom","RED","level highrisk_AML","Web","completed","",""
"00a4ddcb9c9eb8a2c4c319a8","32437","2021-03-27 22:04:32","2021-05-19 22:04:32","","[email protected]","","USA","","","[Over 10000 balance]","ftxcom","GREEN","level ques1_KYC","Web","completed","",""
"00a4eeb03d1d8a6cc1bed0ff","7892c709-74d2-4eb6-856c-7efb92a4156d","2022-02-12 09:03:09","2022-05-06 09:03:09","","[email protected]","","","","","","ftxjp","GREEN","level ques3_AML","","completed","",""
Downloads: great share!
Posts: 11
Threads: 4
Joined: Jul 2023
(Feb 03, 2026, 05:00 PM)thelastwhitehat Wrote:
Description:
In August 2023, Kroll (kroll.com), a financial advisory firm renowned for assisting large companies facing bankruptcy, was the victim of a data breach that affected creditors of FTX, BlockFi, and Genesis. The breach occurred when threat actors targeted a Kroll employee's T-Mobile US account through a SIM swap attack. Notably, T-Mobile, without any authorization from or communication with Kroll or its employee, transferred the employee's phone number to the threat actor's device upon request. With control of the phone number, the threat actors bypassed internal safeguards and accessed sensitive files and documents containing personal information related to the bankruptcy claimants of BlockFi, FTX, and Genesis. The stolen data included full names, email addresses, KYC statuses, and internal notes (such as account balances and risk assessments).
According to well-known cryptocurrency theft investigator ZachXBT, as of December 5, 2025, this breach has led to over $300 million being stolen from the affected individuals through spear phishing campaigns orchestrated by the threat actors.
Please do not contact me about purchasing the entire data set or documents.
Samples:
Spoiler Spoiler
"applicantId","externalId","creationDate","lastReviewDate","applicantName","applicantEmail","applicantPhoneNumber","applicantCountry","rejectType","rejectLabels","customTags","sourceKey","result","applicantLevel","platform","status","userComment","clientComment"
"000a3cac49bf5ac27ae68c7c","134815","2021-12-09 10:48:54","2022-02-13 10:48:54","","[email protected]","","","","","[Over 1000 balance, HIGH-TRANSACTION VOLUME]","ftxcom","GREEN","level ques2_AML","","completed","",""
"000ae08ee74fa544ea3cda0a","user|[email protected]","2021-07-03 10:14:42","2021-09-06 10:14:42","","[email protected]","","USA","RETRY","[COMPANY_NOT_VALIDATED_BENEFICIARIES]","[Over 10000 balance, HIGH-FREQUENCY TRADING]","blockfolio-ftxus","RED","level ques2_AML","Web","completed","",""
"000c9233a194edd85e04ca2e","76989","2023-01-30 05:47:20","2023-02-15 05:47:20","","[email protected]","","USA","","","[Compliance documentation]","ftxcom","GREEN","level ques1_AML","","completed","",""
"000ca51d8e6cc6ff1e1a1f3c","275523","2022-10-30 08:38:21","2023-01-05 08:38:21","ROBIN LOWEY","[email protected]","","","","","[Account recovery requested]","ftxcom","GREEN","level ques1_AML","","completed","",""
"000d97e8b87b6d059f76fa22","320671","2022-06-14 14:31:52","2022-09-12 14:31:52","","[email protected]","","","","","","ftxcom","GREEN","level ques2_AML","Web","completed","",""
"000de6af56ecbc0c0d73fcb2","user|[email protected]","2023-07-25 14:28:35","2023-08-31 00:00:00","","[email protected]","","USA","","","","ftxus","GREEN","level ques3_AML","","completed","",""
"000ecd3bd57be10a23d2df3c","435209","2022-01-16 04:53:40","2022-03-07 04:53:40","KEITH SAMUEL","[email protected]","","","","","","ftxcom","GREEN","level ques2_AML","","completed","",""
"00a0eb9dffb2a7de37aff5e6","user|[email protected]","2023-04-09 20:10:32","2023-04-20 20:10:32","","[email protected]","","USA","","","[HIGH-TRANSACTION VOLUME]","ftxus","GREEN","level ques1_KYC","","completed","",""
"00a2b4fdfd67a88eb3b6dc56","","2021-11-02 15:31:58","2021-11-27 15:31:58","","[email protected]","","USA","","","","ftxus","GREEN","level ques2_AML","Web","completed","",""
"00a3d65dcbb316b3289fea5c","395615","2022-11-21 05:58:10","2023-01-04 05:58:10","","[email protected]","","USA","","","","ftxcom","GREEN","level ques2_AML","Web","completed","",""
"00a3de0d1f96a8fde43caa4a","user|[email protected]","2020-08-13 00:31:47","2020-10-04 00:31:47","","[email protected]","","USA","","","","ftxus","GREEN","level ques1_AML","","completed","",""
"00a4aab3d363a4fab8fd062a","109170","2020-09-07 04:56:27","2020-09-23 04:56:27","","[email protected]","","USA","","","[KYC incomplete, Manual approve, Manual review: High Risk Jurisdiction, Over 1000 balance, Unusual IP detection]","ftxcom","RED","level highrisk_AML","Web","completed","",""
"00a4ddcb9c9eb8a2c4c319a8","32437","2021-03-27 22:04:32","2021-05-19 22:04:32","","[email protected]","","USA","","","[Over 10000 balance]","ftxcom","GREEN","level ques1_KYC","Web","completed","",""
"00a4eeb03d1d8a6cc1bed0ff","7892c709-74d2-4eb6-856c-7efb92a4156d","2022-02-12 09:03:09","2022-05-06 09:03:09","","[email protected]","","","","","","ftxjp","GREEN","level ques3_AML","","completed","",""
Downloads:
thanks bro .
Posts: 70
Threads: 21
Joined: Sep 2023
Thanks for this! the new default reply to unlock is annoying, wish I could just use credits... I feel like a leech
Posts: 113
Threads: 6
Joined: Apr 2026
Thanks for sharing man This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Contact Administration.
Posts: 195
Threads: 38
Joined: Jun 2023
this is the real one , nice share friend
Posts: 1
Threads: 0
Joined: Apr 2026
expected that.. good that i never gave them any ID This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Contact Administration.
Posts: 4
Threads: 0
Joined: Apr 2026
good work man, amazing This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Contact Administration.
Posts: 93
Threads: 37
Joined: Apr 2026
Unfortunately, this data was originally leaked (without permission) from a private circle just a few months after the incident, and now far more people have it than should. As a result, I decided to release it publicly. @ Addka72424, feel free to verify its authenticity.
Please do not contact me about purchasing the entire data set or documents.This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Contact Administration.
|
![[Image: Kroll_Logo_2021.png]](https://bf.st/img/3a5184a8e5aa49733b7da580a91bfd1f30b51b31/68747470733a2f2f65787465726e616c2d636f6e74656e742e6475636b6475636b676f2e636f6d2f69752f3f753d68747470733a2f2f75706c6f61642e77696b696d656469612e6f72672f77696b6970656469612f636f6d6d6f6e732f302f30362f4b726f6c6c5f4c6f676f5f323032312e706e67)
