Binance Handed User Data to Russia That Led to a Donor's Arrest

The documents were obtained by The First Department, an organization that supports defendants in Russian political cases, from one of Belenkiy's relatives.

Investigators, the report said, received two responses from case@binanceholdings.ru after requesting Belenkiy's transaction history. Binance's website had directed Russian and Belarusian law enforcement agencies to that address.

Binance sold its Russian business to CommEX in September 2023, saying operating in the country did not fit its compliance strategy. The company said at the time it kept no revenue-sharing arrangement and no option to repurchase the business. The alleged donations ran from January 2023 to March 2024, so part of the payment window opens before the sale and part runs after it. Reuters reported the disclosure came after the sale closed, and Belenkiy was arrested two years later.

The records Binance sent also fall under European data protection rules. His file included a Bulgarian residency permit; Bulgaria is an EU member state, and GDPR covers the personal data of individuals in the Union. Under GDPR, personal data can leave the bloc only with an adequacy decision from the European Commission or appropriate safeguards in place. Transfers that fit neither must rest on a narrow derogation, such as establishing a legal claim or protecting vital interests. The Commission has no adequacy decision for Russia, and standard contractual clauses are designed for transfers between companies, not for handing records to a police authority. Binance has not said which legal basis it relied on. If a regulator finds the transfer unlawful, GDPR allows fines of up to 4% of global annual turnover or €20 million, whichever is higher.

Binance's current law-enforcement guidelines make a valid court order or warrant a precondition for handing over user information in a criminal investigation. Reuters' report does not say whether Russian investigators presented one. Binance said it cooperates with lawful law enforcement requests subject to applicable law and privacy rules. It declined to discuss Belenkiy's case or whether the disclosure may have breached European data protection rules, according to Reuters.