Binance Handed Russia a User's Full Account History Over $742

Every compliance lead at a global exchange has a slide deck that says "we honor lawful requests from competent authorities." The Yuri Bilenky case is what that slide looks like when it hits a Russian terrorism charge and a Bulgarian residence permit at the same time. It is not a good look, and it is now a live problem for anyone running a KYC'd crypto product with users in adversarial jurisdictions.

As Наша Ніва reported, Binance handed Russia's Investigative Committee the full account trail of a Russian IT specialist who wired money to Ukrainian military support wallets. The exchange had already announced its withdrawal from the Russian market in October 2023. That withdrawal apparently did not sever the compliance pipe.

What Happened

Yuri Bilenky is a Russian IT specialist who had lived in Bulgaria since 2015 and holds a Bulgarian residence permit. Between January 2023 and March 2024, he made six cryptocurrency transfers totaling $742 to wallets that Russian investigators say were tied to the Ukrainian army and the Azov unit. The destination wallet had been published publicly by blogger Arkady Babchenko. This was not sophisticated tradecraft. It was a small donation flow through a public address.

In September 2025, Bilenky was detained at Sheremetyevo Airport in Moscow. Russian investigators charged him with financing terrorism. After the arrest, the Investigative Committee sent Binance a request for information on clients who had transferred funds to the Babchenko-published wallet.

Binance responded with what human rights group Perviy Otdel describes as a full history of Bilenky's account from the moment of registration. That package included personal data, copies of his Russian passport and his Bulgarian residence permit, account balances, transfers between accounts, and deposit and withdrawal history. Reuters reported on the disclosure. Perviy Otdel reviewed the case materials.

The consequence was immediate. Investigators used the Binance data to uncover nine additional transfers Bilenky had made. The charge sheet now covers 15 transactions rather than the six originally identified. A Binance representative told journalists the exchange responds to legitimate requests from law enforcement taking into account privacy and regulatory requirements. Human rights defenders argue that passing personal data to Russian authorities without international legal procedures may violate European data protection law. It is not yet known whether Binance disclosed data on other senders to the same wallets.

Technical Anatomy

Strip the geopolitics away and this is a boring compliance workflow that produced a nightmare outcome. Here is the mechanism.

Public wallet addresses are cheap targets for chain analysis. Once a wallet like the Babchenko donation address is known, any exchange with KYC records and any withdrawal or deposit touching that address becomes trivially subpoena-ready. The clustering does not require Chainalysis magic. It requires one SQL query against the compliance data warehouse: give me every account with an on-chain interaction with wallet X. The response set is a customer list with legal names attached.

Binance's public position is that it exited Russia at the end of 2023. Exiting a market operationally means closing new signups, offloading the local business, and in Binance's case selling the Russian arm. It does not automatically mean deleting historical KYC records, transaction logs, or account snapshots for former Russian users. Those records live in whichever legal entity onboarded the customer. If the onboarding entity is still reachable through a mutual legal assistance channel, or through direct correspondence with an "investigative" body, the data is still gettable.

The disclosed package tells you exactly which internal tables were dumped: identity documents (KYC vendor storage), address of record, ledger balances, internal transfer graph, and the deposit and withdrawal blockchain history. That is essentially the complete customer 360 view every exchange builds for AML monitoring. There is nothing exotic about the retrieval. What is unusual is the counterparty.

The unresolved technical question is jurisdiction routing. Bilenky is a Bulgarian resident. Bulgaria is in the EU. GDPR Article 48 says transfers of personal data in response to a foreign court or authority order are only lawful if grounded in an international agreement such as a mutual legal assistance treaty. Russia and the EU do not have a functioning MLAT relationship in 2026. If Binance's EU-facing entity processed this request, that is a serious problem. If a non-EU entity held the data, the question becomes which entity actually onboarded a Bulgarian resident, and why.

Who Gets Burned

Start with Binance. My take: the reputational hit inside the crypto community is smaller than the regulatory hit that is coming from Sofia and Brussels. European data protection authorities have been looking for a clean case to test crypto exchange data flows against GDPR. This is that case, gift-wrapped. Expect information requests from Bulgarian regulators within the quarter and a coordinated EDPB statement not far behind. The US enforcement posture is a separate axis, but any exchange under an existing consent order does not want a "sold out a user to Russia" narrative in the file.

Next, every other centralized exchange with a global footprint. Coinbase, Kraken, OKX, Bybit, Bitget. Their compliance teams are already fielding the same Monday morning question from their boards: "would we have done what Binance did?" The uncomfortable read: most of them do not have a clear written policy that would have said no. Requests from authoritarian jurisdictions get triaged by "is this a competent authority in a country where we operate," and the answer is often mechanically yes even when the moral answer is obviously no.

Then the users. Anyone who has ever donated to Ukrainian military support wallets, Belarusian opposition wallets, Iranian protest funds, or Hong Kong democracy campaigns through a KYC'd exchange should now assume that history is discoverable. Bilenky's disclosed transfers totaled $742. That is less than a monthly Datadog bill for a mid-sized team, and it was enough to trigger a 15-count terrorism financing case. The threshold for material risk is essentially zero.

Finally, iGaming and fintech platforms watching from the sidelines. If your crypto on-ramp partner is a global CEX, your users' transaction graphs are exposed to the same legal reach. Payments teams I have worked with treat exchange partners as opaque compliance surfaces. They are not opaque. They are subpoena-transparent.

Playbook for Crypto and DeFi

Concrete moves for this week.

If you operate a centralized exchange or a custodial crypto product, write down your law enforcement response policy in public. Include a jurisdictional whitelist of authorities you will accept direct requests from. Everything else routes through MLAT or gets refused. Publish a transparency report with request counts by country. Users need a signal, and "we comply with the law" is not one.

If you are building on Ethereum or Solana and your product touches donations, activism, or any politically exposed flow, stop assuming a public address is a safe endpoint. Rotate deposit addresses per donor using stealth address patterns. The tooling exists. The EIP registry covers ERC-5564 stealth addresses that were built for exactly this pattern. It is not privacy theater. It breaks the trivial SQL join that put Bilenky in a Russian jail.

If you run a fintech or iGaming stack with a KYC'd crypto rail, audit your data retention windows on former-market users. If you exited Russia, Belarus, or Iran, ask counsel a hard question: do we still hold records that a hostile authority could reach? If yes, when do they age out? "Never" is not an answer that survives a GDPR audit.

For DeFi builders, the lesson is older than this case. Non-custodial rails, self-hosted wallet donations, and privacy-preserving mixers under legitimate legal frameworks are the only architectures where a user's activism does not sit in a compliance database waiting for the wrong subpoena. Design accordingly.

Key Takeaways

• Binance disclosed a full KYC and transaction history, including passport and Bulgarian residence permit scans, to Russia's Investigative Committee over $742 in transfers to Ukrainian military wallets.
• Exiting a market in 2023 did not delete the data. Historical records at the onboarding entity remained reachable in 2025.
• Nine additional transfers were surfaced from the disclosed history, expanding the charges from 6 to 15 transactions. Small compliance disclosures create large legal exposure.
• The EU legal question is real: transferring a Bulgarian resident's personal data to Russian authorities without MLAT procedures may breach GDPR Article 48.
• Publish a jurisdictional law enforcement policy, shorten retention windows on former-market users, and design donation flows with stealth addresses. Public wallets plus KYC exchanges equal a subpoena target.