Binance Tourist Billboards in Turkey

Notice: This page is a new case study and some aspects have not been fully researched. Some sections may be incomplete or reflect inaccuracies present in initial sources. Please check the References at the bottom for further information and perform your own additional assessment. Please feel free to contribute by adding any missing information or sources you come across. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Binance Tourist Fake Billboards

Billboards started appearing in Turkey which claimed to be related to the cryptocurrency exchange Binance. From what can be researched, a cryptocurrency broker in Turkey was using the Binance brand far too prominently to build trust with potential customers. There was no specific cases uncovered of any other theft or fraud by that company, although some individuals alleged this was possible on social media.

About Binance

"Back in May, cryptocurrency exchange Binance warned of a rash of bogus billboards popping up in Turkey. Scam artists "plastered fake Binance billboards throughout the country", many of which included a phone number answered by criminals behind the scheme."

This exchange or platform is based in Turkey, or the incident targeted people primarily in Turkey.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

• Known history of when and how the service was started.
• What problems does the company or service claim to solve?
• What marketing materials were used by the firm or business?
• Audits performed, and excerpts that may have been included.
• Business registration documents shown (fake or legitimate).
• How were people recruited to participate?
• Public warnings and announcements prior to the event.

Don't Include:

• Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
• Anything that wasn't reasonably knowable at the time of the event.

There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

The Reality

This sections is included if a case involved deception or information that was unknown at the time. Examples include:

• When the service was actually started (if different than the "official story").
• Who actually ran a service and their own personal history.
• How the service was structured behind the scenes. (For example, there was no "trading bot".)
• Details of what audits reported and how vulnerabilities were missed during auditing.

"The tactic used here was to convince unwary investors to hand over their seed/recovery phrases. Others were asked to register new accounts. Cryptocurrency scams involving new accounts tend to have funds deposited over time. Eventually the scammers have the victim transfer the funds to sites run exclusively by them. No matter which tactic is used, someone pulled in by the billboard has a strong chance of losing out."

"This is clearly a technique which is working for phishers no matter the location. If you're at an event or simply out and about and spot a cryptocurrency billboard, play it safe. Does the billboard mention a digital finance organisation? Check with the organisation if the URL is genuine. If you're asked for seed/recovery phrases, don't hand them over. Does the billboard make claims of doubling whatever you deposit? This is almost certainly a scam, especially if tied to a promotion from Elon Musk or TESLA."

What Happened

Individuals in Turkey operated an exchange service which took a commission and allowed buying or selling cryptocurrencies for local currency. They used the Binance name without authorization for this service.

Key Event Timeline - Binance Tourist Billboards in Turkey

Date	Event	Description
April 7th, 2022 5:56:00 AM MDT	Twitter Post Showing Billboards	Twitter user Doruk Ardahan shares a screenshot of the billboards on Twitter. The caption can be translated to "What's this?" Many users provided details that it was an exchange service operating by phone or out of a local apartment, and the service operated using some features of the Binance platform and used the name Binance name to build trust.
May 8th, 2022 2:04:00 PM MDT	Issue Mentioned On Twitter	Binance posts screenshots of the billboards to their Twitter, making clear that they are not affiliated and mentioning that they will pursue legal actions against the billboard operators. The community response is highly negative against the billboard operators and accuses them of being scammers and frauds.
May 11th, 2022 5:24:00 AM MDT	TheStreet Article Published	An article about the billboards is posted to TheStreet Crypto.
June 23rd, 2022	MalwareBytes Labs Article	The MalwareBytes Labs referenced the attack billboard in an article about a billboard attack as part of NFT NYC. According to their article, the use of rogue billboards as a scam technique in the field of digital finance is becoming more prevalent. Recently, fake billboards advertising cryptocurrency exchange Binance appeared in Turkey, with scammers operating behind the scheme and tricking unsuspecting investors into revealing their seed phrases or registering new accounts. Victims of such scams are often lured into depositing funds that eventually end up being transferred to the scammers' sites. It is important to exercise caution when encountering cryptocurrency billboards, verify the authenticity of the organization mentioned, refrain from providing seed phrases, and be wary of claims promising to double deposits.

Technical Details

Billboards were reported across several regions of Turkey including Konyaaltı, MarkAntalya, and Antalya.

According to Turkish tweets, the billboard owners operated out of an apartment. The business appears to be operating as a commission-based brokerage using the Binance logo without authorization.

Total Amount Lost

There are no reports of any funds being lost in this incident.

Immediate Reactions

When a post about the billboards was initially shared on Twitter. Many users provided details that it was an exchange service operating by phone or out of a local apartment, and the service operated using some features of the Binance platform and used the name Binance name to build trust.

most likely for KYC-free purchases. I think the reason why it is called Binance is that even the street grocer knows Binance.

A cryptocurrency exchange poster made for the Iranians who came to Antalya during the Nevruz period. For crypto exchanges such as currency exchange.

There is no shop, they actually communicate by phone. I haven't seen the shop yet.

It's the work of a vigilant investor using Binance's name..

If I'm not mistaken, binance opened the free transfer feature between users a while ago, and with this feature, they started doing crypto exchange business faster without waiting for wallet approval.

It's very simple, my brother sends arab tourist, the tether or coin is exchanged in his own account, then he withdraws it and gives it back for a certain commission.

Binance Turkey posted on Twitter to announce the billboards were not associated with their company, in a tweet which can be translated as follows:

For a while, billboards similar to the image below have been striking in different regions of Turkey.

The image below has nothing to do with Binance.

Necessary legal processes have been initiated against persons who are clearly involved in fraudulent activities.

Turkish users had various reactions (all translated from Turkish):

Fraud using unauthorized logo , name , brand trust , officially give up . I have no doubt that they will get a record penalty

What does your legal department do, file a lawsuit if you don't mind

It's as if they were going to sue both legally and legally. I don't understand how it happened. (TBD - needs better translation.)

Even the scammer is cheating more by advertising on the boards, no matter how he got rich

Are they renting these billboards from the grocery store? Didn't anyone ask for tax plate, signature circular, stamp, commercial registry etc.??? My God, the country is like a joke or a joke. All kinds of scams are open!!

OC.lar is playing big scam. Since they continue to such large expensive boards, they are holding up well. It will be on TV soon.

According to Twitter users, the culprits were operating out of an apartment and had ads in Konyaaltı, MarkAntalya, and Antalya regions of Turkey.

this image caught my attention, not just a billboard in Antalya, they actually have a place in an apartment.

This is Antalya. They advertise like this from everywhere. Especially in Konyaaltı and MarkAntalya region.

MalwareBytes Allegations of Phishing

MalwareBytes posted a scathing attack on the billboard. According to their article, scammers operating behind the scheme and tricking unsuspecting investors into revealing their seed phrases or registering new accounts. Victims of such scams are often lured into depositing funds that eventually end up being transferred to the scammers' sites. It is important to exercise caution when encountering cryptocurrency billboards, verify the authenticity of the organization mentioned, refrain from providing seed phrases, and be wary of claims promising to double deposits, particularly if associated with Elon Musk or TESLA.

Ultimate Outcome

Binance's tweet mentions that legal processed were started against the individuals behind the malicious billboards.

What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

Total Amount Recovered

There do not appear to have been any funds recovered in this case.

What funds were recovered? What funds were reimbursed for those affected users?

Ongoing Developments

What parts of this case are still remaining to be concluded?

Individual Prevention Policies

This case does not appear to have resulted in a loss to any individual. However, there is speculation that the operation may have been operating fraudulently or targeting private keys of individuals.

When performing an in-person exchange, the risk level can be minimized by reducing the amount transferred at one time, performing the transfer in a more secure location, conducting the transaction with more individuals present, and retaining more identifying information about the counterparty. Having a large amount of cash in one area and improperly secured allows for theft to occur. Be sure that you have physical visibility of any cash to be received prior to authorizing any irreversible payment. Alternatives with lower risk of physical theft such as debit or eTransfer should also be considered.

Private keys can be obtained through seed phrases, mnemonics, private key files, mobile synchronization screens, wallet export features, wallet backups, etc... Never ever send these to anyone else who you do not intend to allow to take all of your money. Attackers will use a wide variety of tactics to convince you like pretending to be your wallet software, pretending they work for the wallet software, or asking you to screen share. Don't fall for them.

For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.

Platform Prevention Policies

This case does not appear to have resulted in a loss to any platform.

For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.

Regulatory Prevention Policies

Create a standard tutorial and quiz for all new cryptocurrency participants, which is required to be completed once per participant. This tutorial and quiz should cover the basics of proper seed phrase protection, strong password generation, secure two-factor authentication, common fraud schemes, how to detect and guard against phishing attacks, how ponzi schemes work, as well as other risks which are unique to the cryptocurrency space.

All platforms should undergo published security and risk assessments by independent third parties. Two assessments are required at founding or major upgrade, one after 3 months, and one every 6 months thereafter. The third parties must not repeat within the past 14 months. A risk assessment needs to include what assets back customer deposits and the risk of default from any third parties being lent to. The security assessment must include ensuring a proper multi-signature wallet, and that all signatories are properly trained. Assessments must be performed on social media, databases, and DNS security.

Set up a multi-signature wallet with private keys held separately by delegate signatories from seven prominent platforms and services within the industry. Establish requirements for contributions by all platforms and services within the country, designed to be affordable for small platforms yet large enough to cover anticipated breach events. Any breach event can be brought forth by a member platform or a petition of 100 signatures for consideration by the delegate signatories. A vote of 4 or more delegate signatures is required to release any funds, which could partially or fully restore lost funds based on their assessment.

For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.