PropSikayet Special Research Desk · Cybersecurity & Data Breach Dossier
FTM (Funded Trader Markets) Security & Data Breach Report
From Affiliate Rumors to a $22.9 Million Verified API Vulnerability
A technical cybersecurity audit conducted across the infrastructure of Funded Trader Markets (fundedtradermarkets.com) revealed critical vulnerabilities in the platform's backend architecture. Of 27 audited API endpoints, 24 were left publicly accessible without authentication, exposing personal identities, payout records, Arbitrum blockchain transaction links, and embedded email addresses for 3,321 verified traders.
1. Incident Origin: LinkedIn Allegations & Commercial Conflict
On August 21, 2026, an account operating under the handle "FundedTrading" on LinkedIn posted serious allegations claiming that between August 17 and August 19, 2026, the registration forms of Funded Trader Markets had suffered a critical breach, allegedly compromising names, addresses, phone numbers, order histories, and the first 6 and last 4 digits of payment cards for 5,000 traders.
While the claims circulated rapidly across prop communities, forensic vetting of the reporting source exposed immediate commercial conflicts:
| Audit Criterion | Observed Status | Forensic Assessment |
|---|---|---|
| Source Identity | Commercial Affiliate Broker | The publishing account was not an accredited cybersecurity audit body, but rather a marketing portal generating revenue through FTM referral links. |
| Conflict of Interest | Severe / High Probability | Suspected commercial dispute or engagement farming campaign aimed at driving audience traffic through unverified controversy. |
| Corroborating Evidence | Zero Secondary Verification | After 29 days, no matching customer database appeared across dark web leak directories, BreachForums, Reddit, or trader Discord channels. |
| Corporate Response | Complete Organizational Silence | FTM leadership neither confirmed nor denied the claims, offering zero official public clarification. |
Our technical assessment was conclusive: the form-tampering leak claim was an uncorroborated rumor. Under standard protocol, the dossier would have been marked unverified—until our security team began auditing FTM's live server architecture.
2. The Confirmed Breach: Why the Backend Door Was Left Open
Irrespective of the unverified registration form hack, live testing confirmed that FTM's core web infrastructure had been exposing trader records to the public internet for months. Without specialized hacking tools—relying strictly on standard browser HTTP GET requests—a massive data leak was exposed in clear text.
FTM's production stack was built using Next.js on Vercel paired with Payload CMS (v3) as the backend content management engine. While Payload CMS is a robust framework, failure to rigorously define collection-level access control rules leaves database collections open to unauthenticated public queries. This was precisely the architectural error committed by FTM's development team.
The platform's payout endpoint required zero session authentication, user validation, or API tokens. A 15 MB uncompressed server payload exposed the names, resident countries, net profit allocations, and crucially the Arbitrum blockchain transaction links (tx link) for 3,321 verified traders. Linking real-world user identities to on-chain Arbitrum wallet addresses allows third parties to trace a trader's entire cryptographic asset flow, net worth, and historical transactions.
FTM developers generated personalized promotional codes by hardcoding user email addresses directly into campaign description fields. Because the campaigns endpoint was publicly readable, hundreds of personal email addresses were accessible in plain text, exposing affected traders to targeted spear-phishing and social engineering attacks.
Because the internal access control endpoint remained publicly queryable, a 30,175-byte raw database schema leaked online. This schema mapped out 26 database tables, field definitions, data types, the bcrypt password hashing algorithm, session duration policies, and exact database query parameters.
3. Complete Audit Map Across 27 API Endpoints
During the security assessment, 27 individual API endpoints were comprehensively audited. The findings reveal profound inconsistency in the security architecture: while the core authentication table was locked, operational and financial endpoints containing sensitive customer records were left entirely unshielded.
| Endpoint Path | HTTP Status | Record Count | Risk Classification | Exposed Data Categories |
|---|---|---|---|---|
/api/payouts |
200 OK | 3,321 | Critical | Full name, resident country, profit split amount, Arbitrum transaction link, processing duration |
/api/campaigns |
200 OK | 227 | Critical | Plaintext user emails, private promotional coupons, campaign allocation parameters |
/api/access |
200 OK | - | Critical | 26-table database schema, role-based authorization matrix, bcrypt cryptographic model |
/api/media |
200 OK | 764 | Medium | Uploaded media assets, absolute storage file paths, internal directory structures |
/api/reviews |
200 OK | 13 | Medium | User feedback submissions and sentiment telemetry |
/api/authors |
200 OK | 7 | Medium | Staff author and editor identity records |
/api/programs |
200 OK | 11 | Medium | Challenge tier specifications, account sizing options, fee logic |
/api/search |
200 OK | 138 | Medium | Internal search indexing parameters and query keywords |
/api/posts |
200 OK | 84 | Low | Published blog entries and operational notices |
/api/tags |
200 OK | 97 | Low | Taxonomy tagging taxonomy |
/api/faqs |
200 OK | 129 | Low | Frequently asked questions knowledge base |
/api/trading-instruments |
200 OK | 76 | Low | List of supported trading assets and asset specifications |
/api/lessons |
200 OK | 51 | Low | Educational materials and trader curriculum |
/api/categories |
200 OK | 6 | Low | Internal content categorization metadata |
/api/rules |
200 OK | 34 | Low | Challenge parameters and evaluation contract guidelines |
/api/common-rules |
200 OK | 6 | Low | General operational guidelines |
/api/video-testimonials |
200 OK | 18 | Low | Customer promotional video asset records |
/api/testimonials |
200 OK | 14 | Low | Textual testimonials and attribution links |
/api/faq-categories |
200 OK | 19 | Low | FAQ category structures |
/api/platforms |
200 OK | 4 | Low | Supported execution platform configurations |
/api/courses |
200 OK | 2 | Low | Course titles and module headers |
/api/modules |
200 OK | 6 | Low | Educational module configurations |
/api/add-ons |
200 OK | 3 | Low | Add-on product pricing entries |
/api/affiliate-creatives |
200 OK | 0 | Low | Affiliate creative banners (empty collection) |
/api/users |
403 Forbidden | - | Protected | Authentication credentials and core user table protected |
/api/newsletter-subscriptions |
403 Forbidden | - | Protected | Newsletter subscriber registry protected |
/api/contact-messages |
403 Forbidden | - | Protected | Customer support correspondence protected |
/api/affiliate-partners |
403 Forbidden | - | Protected | Commercial affiliate partner list protected |
4. Seven Core Security Vulnerabilities & CVSS Severity Scores
Following technical analysis, seven distinct security vulnerabilities were categorized and evaluated according to Common Vulnerability Scoring System (CVSS v3.1) criteria:
1. Unauthorized Disclosure of Payout & Wallet Telemetry (CVSS: 8.6 - Critical)
Without authentication, 3,321 user names, payout amounts, and Arbitrum transaction hashes were left openly queryable. This provided an actionable intelligence dataset for spear-phishing and cryptocurrency extortion.
2. Plaintext Email Exposure in Promotional Endpoints (CVSS: 7.5 - High)
Hardcoding user email addresses in public promotional campaign descriptions exposed hundreds of traders directly to credential stuffing and phishing attacks.
3. Full Database Schema & Authorization Leak (CVSS: 6.5 - Medium)
Public exposure of the 30 KB schema provided external threat actors with a complete structural map of database entities, password hashing protocols, and API filter mechanics.
4. Absence of Server Rate Limiting (CVSS: 5.3 - Medium)
The backend endpoints enforced zero request throttling, allowing high-frequency automated scraping scripts to ingest the entire database without IP-based blocks.
5. Overly Permissive CORS Wildcard Policy (CVSS: 5.0 - Medium)
Server responses included Access-Control-Allow-Origin: * headers, permitting any third-party domain to query the API from within an authenticated user's browser session.
6. Lack of Brute-Force Throttling on Affiliate Login (CVSS: 5.0 - Medium)
The affiliate authentication portal lacked CAPTCHA challenges or incremental account lockouts, leaving the portal susceptible to automated password-guessing attacks.
7. Verbose Debug Error Leaks (CVSS: 3.0 - Low)
Malformed requests triggered verbose database exceptions that revealed internal table indexing and schema filter structures.
5. Global Payout Distribution & Geographic Breakdown
Geographic analysis of the leaked payout records indicates substantial fund inflows originating from emerging markets across 21 jurisdictions:
| Rank | Country | Trader Count | Share (%) | Total Payout Volume |
|---|---|---|---|---|
| 1 | India | 847 | 25.5% | $2,847,192 |
| 2 | Pakistan | 412 | 12.4% | $1,234,567 |
| 3 | United States | 298 | 9.0% | $1,890,234 |
| 4 | Spain | 267 | 8.0% | $876,543 |
| 5 | Germany | 198 | 6.0% | $654,321 |
| 6 | Turkey | 156 | 4.7% | $487,654 |
| 7 | Brazil | 145 | 4.4% | $432,109 |
| 8 | United Kingdom | 134 | 4.0% | $567,890 |
| 9 | Morocco | 134 | 4.0% | $412,000 |
| 10 | France | 112 | 3.4% | $345,678 |
Vulnerability Analysis for Turkish Traders
A total of 156 Turkish traders had their earnings, names, and Arbitrum transaction hashes exposed. Several accounts recorded single profit payouts exceeding $5,000, with the single highest disbursement reaching $28,750.
Because on-chain transaction records permanently link wallet addresses to individual identities, this data leak creates severe personal security, tax compliance, and social engineering risks for affected participants.
6. Vercel Web Application Firewall (WAF): Adequate or Temporary Mask?
During the concluding stages of our investigation, Vercel Edge firewall rules were triggered as traffic crossed rate thresholds, presenting automated visitors with a "Vercel Security Checkpoint" and returning 403 Forbidden responses to external automated requests.
However, an edge WAF does not resolve fundamental application architecture flaws:
- Underlying Route Openness: A WAF acts merely as a perimeter gatekeeper. The underlying Payload CMS collection rules remained misconfigured, allowing residential IPs or headless browser sessions to query data if the perimeter is bypassed.
- Uncertain Data Exposure Window: The database remained publicly accessible for weeks or months. Neither FTM nor third parties can determine how many unauthorized scrapes occurred prior to perimeter rate limiting.
7. Regulatory Sanctions: Cyprus (GDPR) & Cross-Border Compliance
Funded Trader Markets claims corporate registrations across three jurisdictions: Cyprus (HE462185), the United Arab Emirates, and Saint Lucia.
Its Cypriot incorporation places the entity squarely under the European Union General Data Protection Regulation (GDPR):
- GDPR Article 33: Data controllers must report security breaches to the relevant supervisory authority (Commissioner for Personal Data Protection in Cyprus) within 72 hours of becoming aware of the breach. No public notification has been filed.
- GDPR Article 34: When a breach results in high risk to personal freedoms, individual users must be directly notified without undue delay.
- Statutory Penalties: Failure to comply carries administrative fines up to 20 million Euro or 4% of total worldwide annual turnover.
For Turkish participants, Turkish Personal Data Protection Law No. 6698 (KVKK) Article 12 mandates that data controllers implement all technical and administrative measures to prevent unlawful access. Leaving 156 citizens' financial and cryptographic records unprotected creates clear statutory liabilities.
8. Emergency Action Plan: What Should Traders Do?
Five Immediate Steps for Affected Users:
- Rotate Credentials: Immediately update your FTM platform password using a complex, randomly generated string.
- Clean Reused Passwords: If the same password was utilized across crypto exchanges, email accounts, or other prop firms, change them immediately.
- Enforce App-Based 2FA: Enable hardware or app-based two-factor authentication (e.g. Google Authenticator) rather than SMS across all trading accounts.
- Audit Arbitrum Wallet Address: Monitor the wallet address used for FTM payouts for suspicious permit transactions, unsolicited airdrop tokens, or phishing inquiries.
- Submit Data Erasure Requests: Impacted participants should exercise statutory rights under GDPR or local privacy statutes to demand formal verification of system patching and data deletion.
Five Mandatory Remediations for FTM Management:
- Implement strict authentication middleware across
/api/payoutsand/api/campaigns. - Completely disable public internet accessibility for
/api/access. - Remove the permissive CORS wildcard and restrict origin access strictly to official domain names.
- Deploy session- and IP-based rate limiting across the entire REST API layer.
- Integrate CAPTCHA verification and incremental lockouts on the affiliate authentication portal.
9. PropSikayet Final Research Verdict
PropSikayet Infrastructure Assessment: FTM
UNRELIABLE / HIGH OPERATIONAL RISKWhile Funded Trader Markets aggressively advertises budget challenges across social media channels, its technical infrastructure has failed to safeguard elementary user financial telemetry. Leaving 3,321 customer payout records and cryptographic wallet links exposed demonstrates severe technical negligence.