Friend.tech data leak exposes data of 101,183 X users

A Yearn Finance community member under the pseudonym Banteg reported a data leak of 101,183 people who linked their X (formerly Twitter) account to Web3-social network Friend.Tech.

The document itself contains detailed information about users, including wallet addresses and a link to the profile.

Banteg noted that some participants may have granted access to their accounts without fully understanding the agreement. Meanwhile, with permission, Friend.Tech can publish posts on behalf of the user.

According to Spot On Chain analysts, the breach lies in the protocol’s API.

The platform currently requires an invite for full use of its features. However, experts noted that trades can be executed directly through a smart contract without being whitelisted.

Friend.Tech is a decentralised social application integrated with X, allowing the trading of tokenised user shares. The protocol is built on the L2-Base network from Coinbase.

In recent weeks the project has begun to rapidly gain popularity. It has also attracted various celebrities, including Garry Tan, the CEO of the startup accelerator Y Combinator, and NBA player Grayson Allen.

Against the hype, Friend.Tech’s daily fee volume rose to $1.4 million, ranking third behind Ethereum and Lido.

In late 2022, leaked contact details of Vitalik Buterin, Kevin O’Leary, and another 400 million X users. The seller claims to have obtained the data through a vulnerability in the social network.

Huobi subsequently fixed a data breach that had exposed user assets since June 2021. According to white-hat hacker Aaron Phillips, the bug was linked to Huobi’s AWS S3 cloud storage.