Actor 'GoreTerminal' claims leak of Defy Club crypto platform database with 23,149 user accounts
An actor using the handle GoreTerminal claims to have leaked a dataset from DEFY.club, an India-based social crypto platform where users share and track portfolios and discuss cryptocurrency. The dataset reportedly holds about 23,149 user accounts, including more than 23,000 phone numbers and more than 9,000 email addresses. The actor dates the breach to October 30, 2026 at 1:33 PM EDT and presents it as a leak, not a ransom event. Dark Web Informer has not independently verified the dataset's authenticity, source, counts or availability, and the method of acquisition is not disclosed.
Detalhes técnicos
- The archive is described as JSON Lines: DEFYCLUB_UNIQUE.JSONL (6.4 MB uncompressed) and a compressed archive of 805 KB.
- The visible sample shows structured account records with phone and international-phone fields, mobile carrier, IP address, user and account identifiers, platform and device fields, build and previous-version fields, registration region, profile-created timestamp and source/status fields.
- No malware hash, Tox ID, Session ID, Telegram handle or attacker infrastructure is visible in the supplied material.
- The analyst maps the claim to T1213.006 (Data from Information Repositories: Databases) as an inference only. The material does not establish unauthorized access to Defy Club systems.
- If authentic, the exposed data could support targeted phishing, SMS abuse, account impersonation and profiling.
Remediação
The article gives no remediation guidance. Standard measures for potentially affected users and the platform are to watch for phishing and SMS scams, treat unsolicited contact referencing the platform with suspicion, and validate the claim with Defy Club before notifying users.
Linha do tempo
-
Actor 'GoreTerminal' claims leak of Defy Club crypto platform database with 23,149 user accounts
ler a análise desta fonte ocultar
An actor using the handle GoreTerminal claims to have leaked a dataset from DEFY.club, an India-based social crypto platform where users share and track portfolios and discuss cryptocurrency. The dataset reportedly holds about 23,149 user accounts, including more than 23,000 phone numbers and more than 9,000 email addresses. The actor dates the breach to October 30, 2026 at 1:33 PM EDT and presents it as a leak, not a ransom event. Dark Web Informer has not independently verified the dataset's authenticity, source, counts or availability, and the method of acquisition is not disclosed.
Technical Details
- The archive is described as JSON Lines: DEFYCLUB_UNIQUE.JSONL (6.4 MB uncompressed) and a compressed archive of 805 KB.
- The visible sample shows structured account records with phone and international-phone fields, mobile carrier, IP address, user and account identifiers, platform and device fields, build and previous-version fields, registration region, profile-created timestamp and source/status fields.
- No malware hash, Tox ID, Session ID, Telegram handle or attacker infrastructure is visible in the supplied material.
- The analyst maps the claim to T1213.006 (Data from Information Repositories: Databases) as an inference only. The material does not establish unauthorized access to Defy Club systems.
- If authentic, the exposed data could support targeted phishing, SMS abuse, account impersonation and profiling.
Remediation
The article gives no remediation guidance. Standard measures for potentially affected users and the platform are to watch for phishing and SMS scams, treat unsolicited contact referencing the platform with suspicion, and validate the claim with Defy Club before notifying users.