Binance has reportedly shared Russian law enforcement with detailed transaction records and personal identity information tied to a man accused of funding terrorism through cryptocurrency donations linked to Ukrainian fundraising efforts. The disclosure, according to law enforcement documents reviewed by Reuters, became part of the evidence used in Russia’s case against an IT specialist awaiting trial.

Reuters reports that investigators requested the data from Binance and received information connecting the suspect to crypto transfers, along with sensitive personal details such as date of birth, address, phone number, and passport number—along with copies of his documents. Binance, in response to coverage, said it cooperates with lawful information requests subject to applicable legal, privacy, and regulatory requirements, while declining to comment on the specific matter.

Key takeaways

• Reuters reviewed documents indicating Russian authorities asked Binance for a customer’s transaction history and received personal identity details.
• The Russian Investigative Committee alleges the suspect sent more than $700 in crypto between January 2023 and March 2024 to Ukrainian military-related efforts and a banned group.
• Binance’s reported response included links to specific transfers as well as copies of a Russian passport and a Bulgarian residency permit.
• Binance says it generally cooperates with lawful information requests, but it declined to comment on the particular case.

What Russian investigators say the data was used for

Russia’s Investigative Committee alleges that IT specialist Yuri Belenkiy made cryptocurrency transfers totaling more than $700 between January 2023 and March 2024. The allegation is that the funds were directed to the Ukrainian military and to an organization identified by Reuters as the group known at different times as the Azov Brigade and the Azov Regiment.

According to Reuters’ review of law enforcement documents, investigators relied on information attributed to Binance in building the case. Belenkiy was detained in September 2025 and is currently awaiting trial in Russia.

Binance reportedly provided transaction trails and identity documents

The evidentiary link described by Reuters centers on a formal request from Russian authorities to Binance for Belenkiy’s transaction history. Reuters says the company’s response connected him to the alleged transfers.

Beyond blockchain-related activity, the response reportedly included personal identifying information commonly required for law enforcement verification: Belenkiy’s date of birth, address, phone number, and passport number. Reuters also reports that the material provided included copies of a Russian passport and a Bulgarian residency permit, suggesting the request extended beyond tracing crypto flows into confirming the suspect’s identity.

For investors and users, the case underlines a recurring reality of crypto compliance: even when transactions are pseudonymous on-chain, centralized exchange records and customer due diligence can materially shape investigations.

Why Binance’s Russia exit does not remove the data link

Binance announced a full exit from Russia in September 2023, selling its local business to CommEX, according to a Cointelegraph report. That corporate shift did not erase the underlying compliance trail described in the Reuters account—namely, that transaction history and customer information tied to a specific user can remain relevant to later investigations.

This distinction matters. “Exiting” a market typically addresses future operations and licensing, but it does not necessarily eliminate retention or earlier records associated with accounts created and used while a platform operated there. The Reuters reporting implies that the relevant data existed in a form Russian authorities could request, even years after the public announcement of Binance’s exit.

Binance’s response and the broader compliance tension

Reuters says a Binance spokesperson declined to comment on specific confidential law enforcement requests or on the details of individual cases. In a broader explanation given to Cointelegraph, Binance stated that it does not make or enforce laws, determine charges, or decide how any government uses information in legal proceedings. The company added that, like other global financial institutions, it cooperates with lawful information requests from law enforcement worldwide, subject to applicable legal, privacy, and regulatory requirements.

That formulation reflects a familiar compliance tension for crypto exchanges operating at the intersection of financial privacy, customer protection, and state requests. While platforms often frame cooperation as bounded by law and privacy rules, public reporting like this highlights how those safeguards function in practice—particularly when requests target individuals connected to politically sensitive conflicts.

It also raises practical questions for customers and the wider ecosystem: what categories of data exchanges retain; how long they retain it; and how cross-border identity and documentation checks can be combined with transaction history in court filings. The Reuters account does not detail those internal policies, but it shows the end result—law enforcement having both a behavioral trail (transfers) and a personal dossier (identity documents).

What to watch next

As Belenkiy’s case moves forward, attention will likely center on what precisely the court accepts as admissible evidence and whether the exchange-supplied materials are used narrowly for transaction tracing or more broadly for identity verification. More broadly, the episode is a reminder that even after major exchange restructuring or market exits, compliance data can still surface years later when investigators pursue crypto-related allegations.

However, the proposal notes, “Treasury believes that the Act evinces a clear intent for payment stablecoins to serve as an effective means of payment and settlement, including across borders, and application of traditional investment rules to payment stablecoins may frustrate that goal.”

Monday’s action is a follow-up to the Treasury advance notice of the rule, which it issued in September of last year on what was meant to be a tight timeline. The public and the growing industry of stablecoin issuers now have 60 days to weigh in with comments, and the department will be expected to take further months to review them before issuing a final rule.

The proposed rule poses dozens of questions about the best approach to interpreting the law, each of which must be answered before the final sign-off. The industry will pay special attention to how it approaches foreign issuers, such as industry leader Tether. It set a deadline for responses in mid-October.

The law’s one-year target to have its rules implemented passed last month, without the administration meeting the requirement. The next mark is the effective date of the law, which is supposed to come by January 18. It’s unlikely that all the rules will be finalized by then, and new regulations usually come with runways allowing an industry to transition into them.

Austria’s financial regulator has issued its first final penalty under the EU’s Markets in Crypto-Assets Regulation (MiCA), fining crypto platform Bitpanda 70,000 euros (about $82,000) for breaching MiCA’s publication and marketing disclosure rules. The Austrian Financial Market Authority (FMA) said the case was handled under an expedited procedure and that the decision is final.

According to the FMA, the issue centered on Bitpanda’s timing and compliance with mandatory pre-publication and disclosure requirements for a crypto-asset white paper.

Key takeaways

• The FMA fined Bitpanda 70,000 euros for failing to submit the required crypto-asset white paper at least 20 working days before publication.
• Regulators also said Bitpanda issued marketing communications before the white paper was filed.
• Another alleged breach involved marketing material that omitted MiCA-mandated disclaimers, including that it had not been reviewed or approved by a competent authority and that Bitpanda is responsible for the content.
• The penalty was issued as the first published final enforcement under MiCA, signaling the EU framework is moving from licensing and guidance into outcomes.
• Bitpanda stated the problems were limited to formal timing and documentation requirements, and said customer funds and platform security were not affected.

FMA details: white paper submission and marketing timing

In a notice published Friday, the FMA said Bitpanda did not submit a crypto-asset white paper to the regulator at least 20 working days prior to its publication, as MiCA requires. The regulator also reported that Bitpanda distributed a marketing communication before publishing the required white paper.

The regulator’s explanation is significant because MiCA’s approach to investor protection depends heavily on structured disclosures. The white paper is intended to provide standardized information before the public is exposed to an offering or related marketing materials.

Disclosure gaps in marketing materials

The FMA further alleged that another marketing communication failed to include mandatory disclosures. Specifically, the regulator said the content did not state that the material had not been reviewed or approved by a competent authority, and that the crypto-asset provider alone was responsible for the content. The regulator also said the marketing communication lacked required contact details, including a telephone number and email address.

These points matter for compliance teams because they show that regulators are not only checking whether documents exist, but whether the surrounding communications include the specific legal language and contact information required under MiCA.

Expedited proceedings and final decision

The FMA said the case was concluded under an expedited procedure and that the penalty decision is final. While the fine amount is comparatively small relative to some large-scale financial enforcement actions, the regulatory significance is larger: this is presented as the watchdog’s first published final penalty under MiCA.

For market participants, the outcome suggests that formal compliance lapses—such as filing timelines and required statement formatting—are actionable under MiCA, even when the core product or platform functionality is not necessarily implicated.

Bitpanda’s response: timing and formal requirements only

Bitpanda told Cointelegraph that the concerns raised by the FMA related exclusively to the timing and formal requirements surrounding the publication of the white paper and an accompanying information document. The company said customer funds and platform security were not affected and that customers suffered no financial harm.

Bitpanda added that it corrected the issues after receiving notice from the FMA, and it opted for a swift, consensual conclusion of the proceedings.

That framing may influence how investors and users interpret the case. The regulator’s enforcement narrative emphasizes process compliance, while Bitpanda points to the absence of customer impact. Still, the penalty itself indicates that regulators are prepared to treat disclosure mechanics and marketing rules as enforceable obligations under the new regime.

Why this is a broader MiCA signal

MiCA created a harmonized regulatory framework for crypto assets across the European Union, including disclosure standards, marketing requirements, and authorization conditions for crypto companies. The FMA’s action reinforces that MiCA compliance is not limited to licensing status or long-form disclosures alone; marketing materials and document submission timelines are also subject to scrutiny.

Earlier coverage of the implementation of MiCA licensing timelines and transitional measures (including references to the end of certain grace periods) highlighted that firms would eventually face stricter enforcement as operational readiness deadlines were crossed. This penalty fits that pattern: once formal requirements are in effect, regulators can convert guidance into penalties.

For the wider industry, the main uncertainty going forward is how frequently regulators will pursue similar “paperwork” cases and whether enforcement will focus on specific categories of issuers or on any instance of noncompliance with pre-publication timing and mandated marketing language. Market participants should watch for more final decisions across member states as regulators test the boundaries of MiCA’s disclosure and communications requirements.

Readers should pay attention to the next enforcement steps from Austria and other EU jurisdictions—particularly whether additional cases involve similar white-paper submission delays and missing mandatory marketing disclaimers, or whether regulators begin targeting other parts of MiCA compliance such as authorization obligations and ongoing disclosure practices.

The trouble with military hegemony

Nobody can measure how much licensing pressure shaped the scope or speed of that rewrite, and the overhaul also pursued legitimate technical goals. The documented facts are narrower and still damning: a license change made to restrict competitors preceded a rushed replacement of battle-tested cryptographic code, and the replacement contained the flaw now draining wallets. Free and open-source software principles exist precisely to keep security from depending on any one company’s choices. Those principles cannot come with a personality exception.

Zach Herbert is co-founder and CEO of Foundation.

Researchers learned not to look

The deeper failure is what happened to the people who did look. In August 2020, researchers from Shift Crypto and Nunchuk disclosed a multisig verification flaw in Coldcard. Coinkite acknowledged the bug and shipped a fix, and NVK, on the Citadel Dispatch podcast simultaneously branded the disclosure “PR terrorism” and questioned whether a researcher without a CVE counted as a professional. In 2023, when the WalletScrutiny project reported problems reproducing older Coldcard builds, the response labeled the project incompetent or malicious and floated litigation. Independent follow-up later found genuine reproduction problems in older releases and concluded nobody had acted in bad faith.

Every public attack on a researcher changes the math for the next one. Independent review is slow, difficult, and usually unpaid. A researcher weighing months of that work against the prospect of ridicule, blocklists, and legal threats will often spend their time elsewhere. Nobody can prove this culture caused the entropy bug to go unnoticed. What can be said with confidence is that security depends on people being willing to look, and the environment around Coldcard punished looking.