The ghost of a defunct crypto exchange is still haunting the web. A new FTX Japan data leak has exposed personal and financial information from more than 35,000 users—well over a year after the platform officially shut down.
Cybernews researchers discovered an open Amazon S3 bucket on May 12, 2025. It contained more than 26 million files tied to FTX Japan, including HTML-formatted reports, detailed logs, and recently generated user data. The most recent documents, dated July 4, 2024, suggest that backend systems continued operating long after the company ended public operations.
Reports Show Data Was Never Fully Decommissioned
The compromised data shows that automated reporting systems were still running months after FTX Japan fulfilled customer withdrawals in early 2023. This indicates that the shutdown was incomplete on the backend—leaving user data vulnerable long after the public assumed it was safe.
Originally known as Liquid by Quoine, FTX Japan operated under Japan’s strict crypto regulations. The platform was acquired by FTX in 2022, shortly before the global exchange collapsed. FTX founder Sam Bankman-Fried is now serving a 25-year sentence for fraud.
FTX Japan managed to segregate customer funds, allowing it to return assets to users even after the FTX bankruptcy in November 2022. That process ended by February 2023, with the exchange expected to fully wind down.
What Kind of Data Was Leaked?
The leak included detailed reports with:
- Usernames and full names
- Email addresses
- Residential addresses
- FTX account IDs
- Auth0 user IDs (used for login authentication)
- Complete transaction histories, including borrowing and lending data
- Collateral types, margin rates, and risk indicators
- Liquidation warnings and margin risk alerts
In total, researchers found over 35,000 unique user identifiers, exposing a massive amount of personally identifiable information (PII) and financial records.
bitFlyer Acquisition Adds Confusion
In 2024, crypto exchange bitFlyer acquired FTX Japan and rebranded it as Custodiem. The leaked data now raises questions about whether Custodiem’s live infrastructure exposed the bucket—or if the system was an unsecured remnant from the FTX era.
According to Cybernews, it’s unclear whether the data belongs to Custodiem users or to original FTX Japan customers who opted out of migrating to the new platform.
Regulatory and Legal Implications
The leak could violate multiple data protection laws. Under Japanese regulations, crypto platforms must enforce strict cybersecurity standards, including proper data retention, anonymization, encryption, and secure system decommissioning.
The prolonged exposure of unprotected files may breach both domestic and international data privacy standards. If no action is taken, the responsible entity could face legal consequences for mishandling user data.
Cybernews reached out to the company behind the exposed infrastructure. At the time of publication, no response had been received.
Conclusion
ChatGPT said:
The FTX Japan data leak harshly reminds us that shutdowns must include backend systems—especially when they store sensitive data. With over 35,000 users affected and millions of files exposed, the incident raises serious concerns about regulatory compliance and cybersecurity negligence. Whether Custodiem or a ghost system is to blame, the damage to user trust may be lasting.
0 responses to “FTX Japan Data Leak Exposes 35,000 Users More Than a Year After Shutdown”