A certain CEX leaked data of 1.5 million users, with hackers obtaining sensitive information through credential stuffing and scraping methods.

Gate News reports that on March 30, according to the cybersecurity platform VECERT disclosed on March 28, hackers operating under the name PexRat are selling a database on the dark web containing personal information of 1.5 million users from a certain CEX. The data includes sensitive information such as names, email addresses, phone numbers, KYC verification status, login IP addresses, and two-factor authentication methods. Analysis indicates that this incident was not a direct breach of the exchange’s internal servers, but rather that the attackers bypassed the CAPTCHA mechanism, obtaining data through credential stuffing and automated scraping methods. Affected users face a high risk of SIM card hijacking and phishing attacks. At the time of this incident, the exchange’s institutional OTC trading business is experiencing rapid growth, with trading volume already reaching 25% of the total for the entire year of 2025 within just January and February. This is the second data security crisis the exchange has faced, following the leak of 420,000 account credentials in January.