Binance Shared EU Resident's Data With Russian Law Enforcement, Raising GDPR Compliance Questions
Key Takeaways
- •Binance provided Russian law enforcement in 2025 with the personal and transactional data of customer Yuri Belenkiy, and that information was used as evidence in terrorism-financing charges against him.
- •Russian authorities allege that between January 2023 and March 2024, Belenkiy sent more than $700 to entities associated with the Ukrainian military, including a group Moscow designates as a terrorist organization.
- •Binance withdrew fully from the Russian market in September 2023 and says it cooperates with lawful law-enforcement requests globally while not determining how governments use the information provided.
- •Legal experts suggest Belenkiy's Bulgarian residency may place the disclosure under the EU's GDPR, which restricts personal data transfers to jurisdictions such as Russia and allows fines of up to 4% of a company's global annual turnover.
- •In November 2023, Binance pleaded guilty to US federal anti-money-laundering and sanctions charges and agreed to pay roughly $4.3 billion in penalties.

Cryptocurrency exchange Binance provided Russian law enforcement with the personal and transactional data of a customer in 2025, information that was subsequently used to bring terrorism-financing charges against him. The customer, Yuri Belenkiy, is a 49-year-old Russian IT specialist with Bulgarian residency who is detained in Russia awaiting trial. The case highlights how the law-enforcement cooperation that cryptocurrency exchanges routinely extend under anti-money-laundering frameworks can reach users in the countries making the requests.
What the Disclosed Records Show
Investigators requested Belenkiy's transaction history after identifying cryptocurrency transfers linked to Ukrainian military fundraising, an area where digital assets became a prominent donation channel after Russia's 2022 full-scale invasion of Ukraine. The exchange responded by supplying records confirming transfers to a wallet listed by Kremlin critic Arkady Babchenko, a Russian journalist who left his home country and had publicly solicited donations for medical equipment for Ukrainian soldiers.
The shared material included Belenkiy's date of birth, address, telephone number, passport number, and copies of both his Russian passport and Bulgarian residency permit. Russian authorities allege that between January 2023 and March 2024 he sent more than $700 to entities associated with the Ukrainian military, including a group that Moscow designates as a terrorist organization. These details were later incorporated as evidence in the case outline submitted to the Russian prosecutor-general. Russian authorities have previously opened criminal cases over small donations to organizations they designate as extremist or terrorist.
The documents further indicate that investigators asked Binance to identify other individuals who had transferred funds to the same wallet, though the outcome of that request was not disclosed. The exchange's replies came from an email address that Binance's website had previously listed for Russian and Belarusian law enforcement inquiries.
Binance's Position
Binance announced its complete withdrawal from the Russian market in September 2023, stating that operating there was incompatible with its compliance strategy and that no revenue-sharing or buy-back arrangements remained. In a statement, the exchange said it cooperates with lawful information requests from law enforcement globally in accordance with applicable legal and regulatory requirements, and noted that it does not determine how governments use such information. Its law-enforcement cooperation has been a defining feature of its recent corporate history: in November 2023, Binance pleaded guilty to US federal charges over anti-money-laundering and sanctions failures and agreed to pay roughly $4.3 billion in penalties, one of the largest corporate resolutions in US history.
European Data Protection Questions
The incident has nevertheless raised questions about Binance's obligations under European data protection law. Because Belenkiy holds Bulgarian residency, legal experts have suggested that he may be covered by the European Union's General Data Protection Regulation, which generally restricts transfers of personal data to jurisdictions without adequate protections and typically requires a court order for disclosure. The regulation's reach is not limited to companies based in the EU; it can also apply to organizations outside the bloc that offer services to people within it, and Russia is not covered by an EU adequacy decision recognizing its data protections as equivalent. Binance disputed this view, while the European Data Protection Board and Bulgaria's data protection commission declined to comment or did not respond. Under the GDPR, individuals may lodge complaints with their national data protection authority, which has powers to investigate and impose fines of up to 4% of a company's global annual turnover.
The First Department, an NGO supporting people in politically motivated prosecutions in Russia, criticized the exchange for maintaining communication with Russian law enforcement after its public exit from the market.
The origin of the documents was not confirmed, nor was it established whether Belenkiy was registered with Binance as an EU resident.