Binance Tourist Billboards in Turkey

Notice: This page is a new case study and some aspects have not been fully researched. Some sections may be incomplete or reflect inaccuracies present in initial sources. Please check the References at the bottom for further information and perform your own additional assessment. Please feel free to contribute by adding any missing information or sources you come across. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Binance Tourist Fake Billboards

Billboards started appearing in Turkey which claimed to be related to the cryptocurrency exchange Binance. From what can be researched, a cryptocurrency broker in Turkey was using the Binance brand far too prominently to build trust with potential customers. There was no specific cases uncovered of any theft or other fraud by that company, while many individuals alleged this was possible on social media.

About Binance

"Binance is a cryptocurrency exchange which is currently the largest exchange in the world in terms of daily trading volume of cryptocurrencies. It was founded in 2017 and is registered in the Cayman Islands."

"Binance was founded by Changpeng Zhao, a developer who had previously created high frequency trading software. Binance was initially based in China, but later moved its headquarters out of China following the Chinese government's increasing regulation of cryptocurrency."

TBD - Update this description and add proper sources.

About The Billboards

Billboards were reported across several regions of Turkey including Konyaaltı, MarkAntalya, and Antalya. These regions are roughly a 9 hour drive away from capital city Istanbul.

Billboards visible in social media featured the name "BINANCE TOURIST EXCHANGE", the Binance logo, and the logos for popular cryptocurrencies bitcoin, ethereum, tether, ripple, and tron. The billboards provided a local Turkish number which could be called for service.

According to Turkish tweets, the billboard owners operated out of an apartment. The business appears to be operating as a commission-based brokerage using the Binance logo without authorization.

The Reality

What is clearly known is that the individuals behind these billboards did not have the permission of Binance to conduct any sort of business in the country. Binance Turkey publicly announced in a tweet that these individuals were "clearly involved in fraudulent activities" and that "legal processes ha[d] been initiated".

There is speculation and allegations that those who called the number would be convinced to hand over their seed/recovery phrases, or set up a new wallet under their control, which they could later drain.

"The tactic used here was to convince unwary investors to hand over their seed/recovery phrases. Others were asked to register new accounts. Cryptocurrency scams involving new accounts tend to have funds deposited over time. Eventually the scammers have the victim transfer the funds to sites run exclusively by them. No matter which tactic is used, someone pulled in by the billboard has a strong chance of losing out."

"This is clearly a technique which is working for phishers no matter the location. If you're at an event or simply out and about and spot a cryptocurrency billboard, play it safe. Does the billboard mention a digital finance organisation? Check with the organisation if the URL is genuine. If you're asked for seed/recovery phrases, don't hand them over. Does the billboard make claims of doubling whatever you deposit? This is almost certainly a scam, especially if tied to a promotion from Elon Musk or TESLA."

What Happened

Individuals in Turkey operated an exchange service which took a commission and allowed buying or selling cryptocurrencies for local currency. They used the Binance name without authorization for this service.

Key Event Timeline - Binance Tourist Billboards in Turkey

Date	Event	Description
April 7th, 2022 5:56:00 AM MDT	Twitter Post Showing Billboards	Twitter user Doruk Ardahan shares a screenshot of the billboards on Twitter. The caption can be translated to "What's this?" Many users provided details that it was an exchange service operating by phone or out of a local apartment, and the service operated using some features of the Binance platform and used the name Binance name to build trust.
May 8th, 2022 2:04:00 PM MDT	Issue Mentioned On Twitter	Binance posts screenshots of the billboards to their Twitter, making clear that they are not affiliated and mentioning that they will pursue legal actions against the billboard operators. The response is generally negative against the billboard operators and accuses them of being scammers and frauds.
May 11th, 2022 5:24:00 AM MDT	TheStreet Article Published	An article about the billboards is posted to TheStreet Crypto. This article claimed the billboards were present "throughout the country", including in Istanbul, a 9 hour drive away from the location where they were reported. They blasted the billboard advertisers, calling them "scam artists" and "crypto thieves". They claimed those who called the numbers would be "promising opportunities that will never materialize, in exchange for users sharing private information like their seed phrases".
June 23rd, 2022	MalwareBytes Labs Article	The MalwareBytes Labs referenced the attack billboard in an article about a billboard attack as part of NFT NYC. According to their article, the use of rogue billboards as a scam technique in the field of digital finance is becoming more prevalent. Recently, fake billboards advertising cryptocurrency exchange Binance appeared in Turkey, with scammers operating behind the scheme and tricking unsuspecting investors into revealing their seed phrases or registering new accounts. Victims of such scams are often lured into depositing funds that eventually end up being transferred to the scammers' sites. It is important to exercise caution when encountering cryptocurrency billboards, verify the authenticity of the organization mentioned, refrain from providing seed phrases, and be wary of claims promising to double deposits.

Technical Details

Billboards were reported across several regions of Turkey including Konyaaltı, MarkAntalya, and Antalya.

According to Turkish tweets, the billboard owners operated out of an apartment. The business appears to be operating as a commission-based brokerage using the Binance logo without authorization.

Total Amount Lost

There are no reports of any funds being lost in this incident. While some responses from Turkish residents on Twitter were critical of the billboards, and it was clear that the Binance name was used without permission, no tweets could be found to back up any claim of lost funds.

Immediate Reactions

Binance shared a tweet which was critical of the billboards. While many responses were critical of the billboards, many local residents explained that the services were nothing more than a commissioned cryptocurrency swap service which had incorporated the Binance name because it was well-known. International media reports published by The Street reported that users were being asked for seed phrases or tricked into placing funds into fake investment websites without providing any evidence to back up these claims.

Initial Tweet By Binance Turkey

Binance's Turkish branch publicly announced in a tweet that these individuals were "clearly involved in fraudulent activities" and that "legal processes ha[d] been initiated".

For a while, billboards similar to the image below have been striking in different regions of Turkey.

The image below has nothing to do with Binance.

Necessary legal processes have been initiated against persons who are clearly involved in fraudulent activities.

When a post about the billboards was initially shared on Twitter. Many users provided details that it was an exchange service operating by phone or out of a local apartment. The service operated using some features of the Binance platform and used the name Binance name to build trust.

most likely for KYC-free purchases. I think the reason why it is called Binance is that even the street grocer knows Binance.

A cryptocurrency exchange poster made for the Iranians who came to Antalya during the Nevruz period. For crypto exchanges such as currency exchange.

There is no shop, they actually communicate by phone. I haven't seen the shop yet.

It's the work of a vigilant investor using Binance's name..

If I'm not mistaken, binance opened the free transfer feature between users a while ago, and with this feature, they started doing crypto exchange business faster without waiting for wallet approval.

It's very simple, my brother sends arab tourist, the tether or coin is exchanged in his own account, then he withdraws it and gives it back for a certain commission.

According to Twitter users, the culprits were operating an exchange service out of a local apartment and had ads in Konyaaltı, MarkAntalya, and Antalya regions of Turkey.

this image caught my attention, not just a billboard in Antalya, they actually have a place in an apartment.

This is Antalya. They advertise like this from everywhere. Especially in Konyaaltı and MarkAntalya region.

Turkish users also had various reactions (all translated from Turkish):

Fraud using unauthorized logo , name , brand trust , officially give up . I have no doubt that they will get a record penalty

What does your legal department do, file a lawsuit if you don't mind

It's as if they were going to sue both legally and legally. I don't understand how it happened. (TBD - needs better translation.)

Even the scammer is cheating more by advertising on the boards, no matter how he got rich

Are they renting these billboards from the grocery store? Didn't anyone ask for tax plate, signature circular, stamp, commercial registry etc.??? My God, the country is like a joke or a joke. All kinds of scams are open!!

OC.lar is playing big scam. Since they continue to such large expensive boards, they are holding up well. It will be on TV soon.

New Media Allegations of Scam Attacks

An article by cryptocurrency news outlet The Street called the billboard advertisers "scam artists" and "crypto thieves", and reported they had "plastered fake Binance billboards throughout the country", claiming the number provided was "fake". They claimed those who called the numbers would be "promising opportunities that will never materialize, in exchange for users sharing private information like their seed phrases".

MalwareBytes posted a scathing attack on the billboard. Allegations published by MalwareBytes, a common computer security software, claimed that the perpetrators had been "promising opportunities that will never materialize, in exchange for users sharing private information like their seed phrases". Echoing the allegations of The Street, they claimed scammers operating behind the scheme were tricking unsuspecting investors into revealing their seed phrases or registering new accounts. Victims of such scams are often lured into depositing funds that eventually end up being transferred to the scammers' sites. They advised readers to exercise caution when encountering cryptocurrency billboards, verify the authenticity of the organization mentioned, refrain from providing seed phrases, and be wary of claims promising to double deposits, particularly if associated with Elon Musk or TESLA.

Ultimate Outcome

Binance's tweet mentions that legal processed were started against the individuals behind the malicious billboards.

What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

Total Amount Recovered

There do not appear to have been any funds recovered in this case.

What funds were recovered? What funds were reimbursed for those affected users?

Ongoing Developments

What parts of this case are still remaining to be concluded?

Individual Prevention Policies

This case does not appear to have resulted in a loss to any individual. However, there is speculation that the operation may have been operating fraudulently or targeting private keys of individuals.

When performing an in-person exchange, the risk level can be minimized by reducing the amount transferred at one time, performing the transfer in a more secure location, conducting the transaction with more individuals present, and retaining more identifying information about the counterparty. Having a large amount of cash in one area and improperly secured allows for theft to occur. Be sure that you have physical visibility of any cash to be received prior to authorizing any irreversible payment. Alternatives with lower risk of physical theft such as debit or eTransfer should also be considered.

Private keys can be obtained through seed phrases, mnemonics, private key files, mobile synchronization screens, wallet export features, wallet backups, etc... Never ever send these to anyone else who you do not intend to allow to take all of your money. Attackers will use a wide variety of tactics to convince you like pretending to be your wallet software, pretending they work for the wallet software, or asking you to screen share. Don't fall for them.

For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.

Platform Prevention Policies

This case does not appear to have resulted in a loss to any platform.

For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.

Regulatory Prevention Policies

Create a standard tutorial and quiz for all new cryptocurrency participants, which is required to be completed once per participant. This tutorial and quiz should cover the basics of proper seed phrase protection, strong password generation, secure two-factor authentication, common fraud schemes, how to detect and guard against phishing attacks, how ponzi schemes work, as well as other risks which are unique to the cryptocurrency space.

All platforms should undergo published security and risk assessments by independent third parties. Two assessments are required at founding or major upgrade, one after 3 months, and one every 6 months thereafter. The third parties must not repeat within the past 14 months. A risk assessment needs to include what assets back customer deposits and the risk of default from any third parties being lent to. The security assessment must include ensuring a proper multi-signature wallet, and that all signatories are properly trained. Assessments must be performed on social media, databases, and DNS security.

Set up a multi-signature wallet with private keys held separately by delegate signatories from seven prominent platforms and services within the industry. Establish requirements for contributions by all platforms and services within the country, designed to be affordable for small platforms yet large enough to cover anticipated breach events. Any breach event can be brought forth by a member platform or a petition of 100 signatures for consideration by the delegate signatories. A vote of 4 or more delegate signatures is required to release any funds, which could partially or fully restore lost funds based on their assessment.

For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.