Binance says a claim that hackers stole 335 million user records is unverified and appears to be a fraud, after a preliminary review found no evidence of a breach.
Binance has publicly disputed a claim posted by the hacking group ShinyHunters that it stole 335.9 million records belonging to Binance users. The exchange said a preliminary review of the sample data shared on an underground forum found no evidence of a breach of its systems or customer information, and that the listing is likely a scam.
According to ThreatMon, ShinyHunters advertised a dataset containing 335,900,000 lines of information covering roughly 170 countries. The claimed contents include email addresses, phone numbers, passwords, identification documents, transaction histories, internal infrastructure details, and private keys for external wallets and Binance hot wallets. The group demanded 900,000 BTC or XMR and warned Binance of a “pay or leak” ultimatum.
A Binance spokesperson told crypto.news that the exchange is actively investigating the claims but, based on the description and the sample reviewed, “this appears likely to be a scam rather than evidence of a Binance systems breach.” The spokesperson highlighted several inconsistencies: Binance does not store passwords in plaintext, it does not hold private keys for users’ external wallets, and the alleged list includes jurisdictions where Binance no longer operates. The exchange suggested the data could stem from infostealer malware that harvests credentials from individual devices rather than a direct compromise of Binance’s infrastructure.
The allegation surfaced weeks after Binance confirmed a hot‑wallet attack on October 29, in which attackers stole about $6.34 billion worth of crypto by compromising employee devices and wallet‑signing infrastructure. Binance reported that roughly $2.85 billion of the stolen assets were frozen or recovered, and it later requested the return of 8,425.997 ETH and 74.56 million ARB. While that incident involved unauthorized transfers, the current claim concerns user‑level data and appears unrelated to the earlier breach.
Observers will monitor Binance’s ongoing investigation for any forensic evidence that could confirm or refute the data‑theft claim. Additional scrutiny is expected on the ShinyHunters group, which has previously advertised alleged breaches of other firms. Users are advised to stay vigilant against phishing attempts that mimic Binance security alerts and to avoid sharing passwords, 2FA codes, seed phrases, or private keys.
Discussion 0