On October 12, 2024, Unchained published a report that cut through the noise. Binance had shared customer data with Russian investigators. The data included passport scans, transaction logs, and wallet addresses. The recipient: the Russian Federal Security Service (FSB), investigating a donation to Ukraine's Azov Regiment. The donor: a dual Russian-Bulgarian national. The charge: financing terrorism.
This is not a story about a bug. It is a story about a system executing exactly as written.
Context: The Exit That Wasn't
In 2023, Binance announced it had "fully exited Russia." It sold its local business to CommEX, a new entity. The narrative was clean: Binance was distancing itself from a sanctioned jurisdiction. The market applauded. But the infrastructure remained. Binance's website still hosts a dedicated page for "Russian and Belarusian law enforcement agencies" to submit data requests. The KYC system, the transaction database, the identity verification pipeline—all still operational. The exit was a legal fiction, not a technical one.
The report confirms that the data request was processed through this channel. The FSB received a reply from the address listed on that page. The data included the user's full identity documents, transaction history, and wallet addresses. The user was not a Binance employee. He was a customer.
Core: The Structural Anatomy of a Data Leak
Let me be precise. This is not a leak. It is a feature. Binance's law enforcement response system (LERS) is designed to handle requests from any jurisdiction. The system does not judge the legitimacy of the request—it validates the format. The code executes exactly as written, not as intended.
From my experience auditing centralized systems, I recognize the pattern. During the 2023 Solana transaction replay incident, I discovered that the prioritization fee market favored large whales, creating a centralization vector. Similarly, here, the centralization vector is the data itself. Once a user submits KYC data to a centralized exchange, they lose control over its distribution. The exchange becomes the gatekeeper. And gatekeepers can be compelled.
The technical flow is straightforward:
- Law enforcement submits a request to the designated channel.
- Binance's compliance team validates the request's legal basis (according to local law).
- Internal systems extract the relevant user data.
- Data is transmitted back through the same channel.
If the request is from Russia, the Russian law enforcement channel is used. If it is from the U.S., the U.S. channel is used. The system is jurisdiction-agnostic. It is a machine that processes inputs.
Probability does not forgive edge cases. The edge case here is that the request came from a country that is under Western sanctions. But the system does not have a binary flag for "sanctioned jurisdiction" because Binance's legal team determined that complying with local law is the baseline. The CEO Richard Teng defended this: "We operate globally, and we must engage with all jurisdictions." He is correct, but only within the narrow frame of legal compliance. The wider frame includes user trust, political risk, and the contradiction between the "exit" narrative and operational reality.
The Data as a Weapon
The data shared was not just transaction history. It included identity documents. This is the kind of data that can be used to target individuals in a conflict zone. The user was accused of financing terrorism because he donated to a Ukrainian military unit that Russia classifies as a terrorist organization. The West does not. This is the fractal nature of incentives: one jurisdiction's legitimate donation is another's crime.
Logic is binary; incentives are fractal. Binance cannot serve two masters. The more it complies with Russian requests, the more it risks violating GDPR, which protects EU residents. The donor held a Bulgarian residence permit, making him a potential EU data subject. If he is an EU resident, the data transfer may be illegal under GDPR. Stellar Consulting founder Mike Bystrov stated that without a court order, the disclosure likely violates GDPR. Binance's response: "We comply with legitimate requests." But legitimacy is not a constant—it is a variable.
Contrarian: The Bulls Were Right, Mostly
The bulls will argue that Binance is simply following the law. Cooperation with law enforcement is not a bug; it is a requirement for a regulated financial institution. Without such cooperation, exchanges would be havens for money laundering and terrorism financing. The market has largely priced in Binance's compliance risks. After the 2023 DOJ settlement, the narrative shifted from "Binance is rogue" to "Binance is paying the price to become legitimate."
But the bulls missed the structural risk. The assumption was that Binance's exit from Russia meant a clean break. The data shows otherwise. The infrastructure was never dismantled. The LERS remained. The bulls overestimated the completeness of the exit. This is a classic information asymmetry: the market believed the narrative, not the code.
In my 2024 analysis of Bitcoin ETF custody solutions, I found that two asset managers used multi-sig wallets with key holders in weak legal jurisdictions. The marketing said "secure custody"; the reality was a legal loophole. Similarly, here, the marketing said "exited Russia"; the reality is a data-sharing pipeline.
Takeaway: The Accountability Call
The industry must stop treating centralized exchanges as neutral infrastructure. They are not. They are data custodians with geopolitical obligations. The question is not whether Binance complied with Russian law—it did. The question is whether users can trust that their data will not be used against them in a conflict. The answer is no. Certainty is a luxury; risk is the baseline.
If you are a user in a politically sensitive region, your KYC data is a liability. The only way to protect it is to not give it. That means self-custody, decentralized exchanges, and a willingness to trade convenience for sovereignty. The code executes exactly as written. The narrative is what we tell ourselves to sleep at night.
