RBXExchange Alleged Data Exposure
The 2018 RBXExchange data breach affects RBXExchange (rbx.exchange), an unauthorized third-party virtual marketplace that facilitated the purchasing, selling, and exchange of Roblox platform currency (Robux) and virtual catalog items.
Exposed Data Types
6- Email addresses
- Usernames
- Passwords
- IP addresses
- Transaction histories
- Virtual currency balances
About This Record
In May 2018, the production MySQL database of the platform was compromised and subsequently distributed across cybercrime and game cracking communities.
What information was affected in the RBXExchange incident?
The leaked SQL database dump (rbx.exchange.sql) and user export files (rbx.exchange_users.txt) contain over 110,000 player accounts and extensive transaction logs comprising:
- Identity & Gamer Profiles: Platform usernames, connected Roblox player identifiers, and Discord handles.
- Contact Coordinates: Validated user email addresses.
- Authentication Credentials: User account passwords hashed with the bcrypt cryptographic algorithm (
$2y$10$). - Network Telemetry: User registration and login IP addresses.
- Virtual Currency & Invoicing Data: Robux and token balances, invoice transaction records across payment gateways (PayPal, Stripe, Bitcoin), and customer support correspondence.
How many accounts were affected?
Rigorous RFC 5322 ASCII canonical verification confirmed 114,785 unique valid email addresses across the database records.
Technical analysis and security risks
Although passwords were encrypted via bcrypt, gamers frequently utilize identical credentials across their official Roblox accounts, email services, and gaming communities. Threat actors routinely leverage exposed credentials from third-party Robux marketplaces in automated credential stuffing attacks to compromise official Roblox player profiles and liquidate rare limited virtual items.
Recommended actions for affected individuals
Users who previously registered with RBXExchange should:
- Immediately change passwords on their official Roblox accounts, email accounts, and Discord profiles.
- Enable two-step verification (2SV / MFA) using an authenticator app on their official Roblox profile.
- Avoid using unauthorized third-party trading sites that violate platform terms of service.
Verification and editorial method
LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.
Report missing or incorrect information
