Loading story…
Iran’s Ariomex cryptocurrency exchange suffered a significant data leak that exposed sensitive user and transaction information spanning 2022–2025, according to findings published by Resecurity. The leaked database reportedly contained 11,826 customer records (about 7,710 associated with Iran based on IP/network intelligence) and included user identities, email addresses, IP addresses, transaction histories, and contextual details about cryptocurrency operations; some records reportedly showed missing or altered KYC information despite high-value activity. Resecurity’s analysis also highlighted examples of suspicious, multi-million-dollar transactions and communications suggesting attempts to move large sums, and noted that some users appeared to treat the exchange as a de facto “bank” for storing crypto.
Reporting indicated the exposure likely originated from a compromised customer support system, and the stolen data has been circulating on dark web channels. The dataset’s geographic indicators suggest Iranian crypto holders’ activity across multiple countries (including the US and several European jurisdictions), which could enable follow-on risks such as user identification, targeting, and potential investigative mapping of illicit financial activity. Separate coverage on Iran’s Nobitex exchange focused on market/chain-analysis and a prior 2025 hack, and did not describe the Ariomex leak itself.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
On or before early March 2026, Resecurity publicly reported the Ariomex data leak and said the records suggested possible sanctions-evasion and money-laundering activity, including high-value transfers and heavy use of TRON-based stablecoins such as USDT. The firm said the leak could help map the global footprint of Iranian crypto holders and identify potentially illicit financial activity.
Resecurity reported that a stolen Ariomex database was being circulated on dark web channels. The exposed data included personal identifiers, transaction histories, and operational details linked to cryptocurrency activity.
Resecurity assessed that the most likely root cause of the Ariomex exposure was a compromise of the exchange's customer support or helpdesk environment. The compromise allegedly enabled theft of sensitive user and transaction data later seen in the leaked database.
The leaked Ariomex database contained user identity, account activity, IP address, and transaction records spanning the period from 2022 through 2025. Reports said the dataset included 11,826 records, with many tied to users in Iran and some showing missing or altered KYC information.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
teiss.co.uk
Open sourcebankinfosecurity.com
Open sourcegovinfosecurity.com
Open sourcescworld.com
Open sourcesecurityaffairs.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Reporting on Iran’s domestic instability and state pressure indicates **cryptocurrency usage has expanded sharply** as both a financial outlet for citizens and a funding channel for regime-linked actors. Chainalysis assessed Iran’s crypto ecosystem at **~$7.78B in 2025**, with activity correlating to political events and conflict; it also reported that **IRGC-linked on-chain activity represented ~50% of Iran’s total crypto activity in Q4 2025** and has been increasing over time. The same analysis noted that during recent mass protests, Iranians **increased Bitcoin withdrawals to personal wallets**, consistent with capital flight behavior amid currency collapse and political instability. Separately, AlphaHunt reported telemetry consistent with an **intentional national internet shutdown** in Iran on **2026-01-08** (traffic falling to near-zero), alongside indicators such as a **~98.5% drop in IPv6 routing announcements** observed by Cloudflare earlier that day. Based on prior patterns of Iran-linked operations (e.g., **APT42**), the post-blackout period is assessed as higher risk for **rapid phishing, credential theft, and account takeovers** targeting officials, journalists, and dissidents—driven more by “regime security” requirements (identification, monitoring, intimidation) than by novel technical exploitation.
Jun 29, 2026
A significant data breach at Ravin Academy, a cybersecurity training center linked to Iran's Ministry of Intelligence and Security, resulted in the exposure of personal information belonging to over 1,000 individuals enrolled in its technical programs. The leaked records included usernames and phone numbers, and the incident was confirmed by the organization via its Telegram channel. Ravin Academy, established in 2019 and sanctioned by the U.S. Treasury in 2022 for supporting Iranian intelligence operations, offers courses in both defensive and offensive cyber skills, such as red-teaming, malware reverse engineering, and vulnerability analysis. The full dataset was provided to U.K.-based activist Nariman Gharib, who published portions of the information online. The academy characterized the breach as an attempt to damage its reputation and undermine national cybersecurity efforts in Iran. This incident occurred amid heightened Iranian cyber activity and increased tensions with Israel and the U.S., including a surge in ransomware attacks targeting healthcare and public health organizations. The breach highlights ongoing risks to organizations involved in nation-state cyber operations and the potential for sensitive data exposure to impact both individuals and broader security initiatives.
Jul 12, 2026
Coinbase confirmed an **insider data breach** in which a single contractor improperly accessed customer information affecting approximately **30 customers**. Coinbase said its security team detected the activity, the contractor no longer provides services to the company, impacted users were notified, and **identity theft protection** was offered; Coinbase also reported the incident to relevant regulators. The disclosure followed brief Telegram posts by threat actors showing screenshots of an internal **Coinbase support interface** that appeared to expose access to sensitive customer data, including **names, email addresses, phone numbers, dates of birth, and KYC information** (and, per the leaked interface screenshots, potentially wallet balances and transaction details). Reporting indicated the incident is **separate from the previously disclosed TaskUs-related insider breach**, and it remains unclear whether the group that posted the screenshots (reported as **“Scattered Lapsus Hunters”**) conducted the access or merely obtained and shared the data; the incident highlights ongoing targeting of **BPO/contractor ecosystems** due to their privileged access to internal tools and customer records.
Jun 29, 2026