Binance calls ShinyHunters’ claim of 335.9 million records a scam

Binance has rejected a ShinyHunters claim involving 335,900,000 lines of purported Binance user records, saying its preliminary review found the listing likely a scam and no evidence of compromised systems or customer data.

The claim surfaced in an underground forum listing attributed to ShinyHunters and reported by cybersecurity monitoring account ThreatMon. The seller demanded $900,000 in Bitcoin or Monero and threatened to release the dataset if Binance did not pay.

ThreatMon said the seller described 335,900,000 lines associated with Binance users across approximately 170 countries. The advertised records allegedly included email addresses, telephone numbers, passwords, identification documents, transaction histories and other personal details.

A Binance spokesperson told crypto.news: “We are aware of the claims made on a hacking forum and on X regarding an alleged Binance user data set, and we are actively investigating them. Based on the description provided and the sample information reviewed so far, this appears likely to be a scam rather than evidence of a Binance systems breach.”

Binance said its review had found no indication that customer identity documents, account credentials, wallet private keys or internal infrastructure information had been exposed through the advertised dataset.

What makes the listing questionable?

• Passwords: Binance said it does not store user passwords in plaintext, contradicting the listing’s description of the records.
• External wallets: The exchange said it does not hold private keys for users’ external wallets, making that part of the allegation inconsistent with its operations.
• Geography: The listing includes jurisdictions where Binance no longer operates, another discrepancy the spokesperson identified.

The spokesperson added: “Similar past listings have often involved infostealer malware data collected from users’ own devices rather than a breach of Binance systems.” Infostealer malware targets individual devices and can capture credentials or other sensitive information.

Beyond personal details, ShinyHunters claimed the dataset included internal infrastructure records, private wallet keys and information about cryptocurrency assets held in Binance’s hot wallets.

ThreatMon said the seller placed sample records behind a forum paywall, but the account had not independently verified the alleged breach, particularly the claims concerning Binance’s hot wallets and private keys. The advertisement warned that Binance had two choices: pay or face publication of the data.

ThreatMon said ShinyHunters had previously advertised alleged breaches involving Salesforce Data.com, Indian electronics retailer Vijay Sales and Kuwaiti government entities.

Is this connected to the $6.34 billion October breach?

No. The ShinyHunters listing is separate from a confirmed security breach on October 29, when attackers stole approximately $6.34 billion in cryptocurrency from Binance’s hot wallets.

Binance’s November 3 incident report traced that theft to compromised employee devices, malicious software and stolen credentials that eventually gave attackers unauthorized access to wallet-signing infrastructure.

The exchange said it froze or intercepted approximately $2.85 billion and used company resources to replace affected customer assets. On November 5, Binance requested the return of 8,425.997 ETH and approximately 74.56 million ARB frozen after the attack.

The October incident involved unauthorized cryptocurrency transfers; the ShinyHunters listing alleges the theft of customer records and credentials.

What should customers do?

Binance separately warned customers about phishing messages that impersonated exchange security alerts and directed recipients to fraudulent websites designed to collect login information.

The spokesperson urged users to treat suspicious communications cautiously and avoid disclosing passwords, two-factor authentication codes, wallet seed phrases or private keys.

Binance has set no public deadline for completing its review, so the next checkpoint is whether its investigation or independent verification connects the sample data to Binance systems; until then, the 335.9 million-line claim remains unverified.