---
id: 5294
title: "How I dumped users’ passports from the exchange"
source_domain: hackenproof.com
source_url: "https://hackenproof.com/blog/critical-severity-kyc-verification-vulnerability"
published_at: "2026-06-11 10:25"
tags: ["bug-bounty", "vulnerability-research", "data-exposure", "brute-force", "writeup", "crypto-exchange", "kyc"]
phying_url: "https://phying.com/item/5294"
lang: en
---

# How I dumped users’ passports from the exchange

## Summary

A critical KYC flaw on a crypto exchange: predictable Unix-timestamp filenames and public storage let a researcher brute-force file URLs and dump users' passports.

## Intelligence Metadata

- **Sources:** hackenproof.com
- **Published:** 2026-06-11 10:25
- **Original:** https://hackenproof.com/blog/critical-severity-kyc-verification-vulnerability
- **Phying News:** https://phying.com/item/5294