Iran’s Ariomex Crypto Exchange Hit by Major Data Breach, Exposing Thousands of User Records Iran’s Ariomex cryptocurrency exchange has suffered a significant data breach, leaking 11,826 records, with roughly 7,710 tied to Iranian users. The exposed data reported by cybersecurity firm Resecurity and detailed by Security Affairs includes user identities, email addresses, IP addresses, and cryptocurrency transaction details, some involving millions of U.S. dollars. Many records lacked KYC verification or contained altered information, raising concerns about illicit financial activity. The breach occurred on February 24, 2025, when threat actor FulcrumSec exploited the React2Shell vulnerability in an unpatched React frontend application, gaining access to Ariomex’s AWS infrastructure. The stolen data has since circulated on the dark web, potentially aiding in the identification of cryptocurrency holders linked to Iran’s financial ecosystem. The incident highlights vulnerabilities in customer support systems and the risks of unpatched software in cryptocurrency platforms. The exposed records span transactions from 2022 to 2025, revealing the global reach of Iranian crypto users and the potential for regulatory or law enforcement scrutiny.

Iran-Based Crypto Exchange Ariomex Hit by Major Data Leak On March 3, 2026, cybersecurity firm Resecurity revealed that Ariomex, a prominent Iranian cryptocurrency exchange, suffered a data breach exposing sensitive user and transaction records spanning 2022 to 2025. The leaked database, now circulating on the Dark Web, includes details of over 11,800 users approximately 7,710 of whom are linked to Iran along with their identities, email addresses, IP data, and cryptocurrency operations. The breach uncovered high-value transactions, including requests to deposit or exchange millions of USD, some allegedly facilitated through Iranian diplomatic channels. Notably, some users treated Ariomex as a de facto bank, storing large sums in crypto without immediate cash-outs. Resecurity also identified suspicious activity, such as accounts with substantial balances lacking proper KYC verification or containing altered information. The exposed data highlights the global footprint of Iranian crypto holders, with records tied to users in the U.S., U.K., Germany, and other countries. The breach’s root cause appears to stem from a compromised customer support system, allowing threat actors to access and exfiltrate the database. This incident follows a 2025 cyberattack on Nobitex, another Iranian exchange, which resulted in the loss of $90 million in digital assets. Resecurity suggests Ariomex operates as a shadow financial entity aligned with the Iranian regime, underscoring the broader risks of unregulated crypto platforms facilitating illicit financial flows.