An exchange left the country years ago — the customer files did not

Law enforcement documents reviewed by Reuters show that Binance supplied personal and transaction data that Russian investigators folded into a terrorism-financing case, almost two years after the company sold its Russian business and described the move as an exit. The person charged is in jail awaiting trial and the allegations have not been decided by any court. The part that matters for ordinary users is narrower and more durable: a company can leave a market while the identity files it collected stay behind.

According to the report, Russian investigators detained an IT specialist named Yuri Belenkiy in September 2025. He is a 49-year-old Russian passport holder who also has a Bulgarian residence permit, and he is accused of sending more than $700 in crypto to Ukrainian recipients between January 2023 and March 2024. Russian authorities say the payments supported a group linked to the Azov military unit, which Moscow designates as a terrorist organization. Binance announced the sale of its Russian business in September 2023 and presented the deal as a complete exit.

The documents describe a later law enforcement request for records connected to him. A response sent from an address using a binanceholdings.ru domain included his date of birth, residential address, phone number and passport number, along with copies of his passport and Bulgarian residence permit. One request also sought details of other customers who had transferred funds to the same wallet, and Reuters could not establish whether anyone was identified. Binance said it cooperates with lawful law enforcement requests under applicable legal, privacy and regulatory requirements, and that it does not decide what charges authorities file or how information is used once produced. Its published guidelines require a valid court order, police order or warrant from a competent jurisdiction and a stated legal basis. The public record does not establish which Binance entity held the account, which law compelled the production, or whether the user was notified.

Underneath the case is a mechanism worth understanding. A blockchain records transfers between addresses, not between passport names, and that pseudonymity holds until an address touches a centralized exchange. The know-your-customer file supplies the missing key, linking a deposit address to a name, a phone number, a document image. Once the identity file and the public ledger are joined, activity from years earlier can be reconstructed. The same rules that require exchanges to collect this data to deter money laundering also produce an archive that outlasts the account.

That leaves users with two kinds of control and one hard limit. Moving coins into self-custody ends the exchange's role in holding them and can limit new records; closing an account can stop future use. Neither erases transfers already written to a public chain, and neither erases records an intermediary is legally required to keep. Even under Europe's GDPR, a deletion request can be refused when the processing is required by law, and the European Commission's own example is a bank that must retain a former customer's details for ten years.

The beginner takeaway is not to avoid verified exchanges, which for most people remain the practical on-ramp. It is to assume that the identity file you hand over outlives the account, to be deliberate about which jurisdiction's platform you hand it to, and to remember that whether a transfer is lawful can be judged differently in different places. This is information, not advice.