Binance founder calls alleged 335.9M-line data sale a scam

By Daniel Okafor

Binance founder Changpeng Zhao on Nov. 9 called a claimed breach involving 335.9 million data lines “obviously fake/scam.” Binance’s preliminary review found no evidence of a compromise connected to the advertised dataset. The seller sought $900,000 in Bitcoin or Monero and threatened publication unless Binance paid.

What did the seller claim?

Zhao’s post quoted ThreatMon’s description of an underground forum advertisement attributed to ShinyHunters. ThreatMon said the alleged breach had not been independently verified. The listing offered:

• 335,900,000 lines associated with users in approximately 170 countries.
• Identity cards and passports, email addresses, phone numbers, account passwords, transaction histories and internal infrastructure details.
• Private wallet keys and information about assets in Binance’s hot wallets, with an asking price of $900,000 in Bitcoin or Monero.

The seller reportedly placed a sample behind a forum paywall. ThreatMon specifically labeled the hot-wallet and private-key allegations as unverified.

Zhao argued that a party holding usable private keys could move cryptocurrency rather than sell those keys for $900,000. “Saw it yesterday, thought it was obvious, but still many media went with it for the headlines,” he wrote. He did not identify individual outlets or specific headlines, and he published no technical examination of the advertised records.

What did Binance find?

Binance had disputed the advertisement before Zhao intervened. A spokesperson said the exchange was actively investigating and had reviewed the description and sample information available at that stage. Its preliminary review characterized the listing as a likely scam and found no indication that the advertised information demonstrated a breach of Binance systems.

Binance identified three inconsistencies. It said the exchange does not store account passwords in plaintext or hold private keys for customers’ external wallets. The listing also referred to jurisdictions where Binance no longer operates, according to the spokesperson.

The exchange suggested that similar past advertisements had involved information collected by infostealer malware from individual users’ devices. Its statement stopped short of establishing that this particular dataset came from such malware.

Has anyone verified the data?

Brandefense documented four versions of a near-identical advertisement dated from Oct. 30 through Nov. 2, without confirming that the data was genuine. The firm found the wording under three Telegram account names and could not determine whether one seller posted the copies or several accounts reposted them.

The advertised price varied. A Nov. 1 version sought a negotiable $500,000, while two Nov. 2 versions mentioned $900,000; one of those suggested the price could fall to $500,000.

Brandefence considered the mixed contents and private-key offer more consistent with recycled information or a scam. The firm had not opened or tested a sample as of Nov. 3. Its analysis also separated a line count from a customer count: 335.9 million lines do not prove that 335.9 million individual customers lost information.

Is this linked to October’s $6.34 billion theft?

Binance’s Nov. 3 incident report described a separate $6.34 billion theft on Oct. 29 involving unauthorized access to its wallet signing service. The exchange traced the intrusion through compromised employee devices and stolen deployment credentials.

Attackers used Ethereum permissions to keep moving assets after Binance suspended normal withdrawals. The report placed the final unauthorized transfer at 2,961.9 ETH, settled at 23:56 UTC on Oct. 29, and cited the FBI’s attribution of the attack to North Korea.

What should customers watch for?

In a separate September warning, Binance described phishing texts alleging suspicious logins or account changes and directing recipients through shortened links. The exchange said it never asks customers to verify or secure their accounts through text-message links.

The next verification window centers on the forum sample and any authenticated leak evidence; until a sample is tested and tied to Binance systems, the advertised 335.9 million-line figure remains a seller claim, not a confirmed breach.