Binance calls ShinyHunters’ alleged 335 million user data breach a likely scam
Binance has disputed claims that hackers stole 335 million user records from the cryptocurrency exchange, saying its preliminary investigation suggests the data listing is likely a scam.
- Binance said ShinyHunters’ claim of stealing 335 million user records was likely a scam, as its preliminary investigation found no evidence of compromised systems or customer data.
- The threat actor allegedly demanded $900,000 in Bitcoin or Monero for a dataset it claimed contained user credentials, identity documents, transaction histories and private wallet keys.
- A Binance spokesperson questioned the listing’s credibility, citing inconsistencies involving plaintext passwords, external wallet private keys and jurisdictions where the exchange no longer operates.
- Binance suggested the advertised information could resemble data collected through infostealer malware targeting individual devices, rather than information obtained from its systems.
A Binance spokesperson told crypto.news that the exchange was investigating allegations circulated on a hacking forum and X, but an initial review of the advertised information had not identified evidence of a new compromise involving its systems or customer data.
“We are aware of the claims made on a hacking forum and on X regarding an alleged Binance user data set, and we are actively investigating them,” the spokesperson said.
“Based on the description provided and the sample information reviewed so far, this appears likely to be a scam rather than evidence of a Binance systems breach.”
The exchange said its review had found no indication that customer identity documents, account credentials, wallet private keys or internal infrastructure information had been exposed through the advertised dataset.
Binance questions credibility of alleged stolen data
According to the spokesperson, several details in the listing do not match how Binance manages customer information or operates its cryptocurrency services.
One concern involves the claim that the stolen records contain account passwords. Binance said it does not store user passwords in plaintext, which contradicts the way the alleged information was described.
The listing further claims to contain private keys belonging to cryptocurrency wallets. Binance explained that it does not hold private keys for users’ external wallets, making that part of the allegation questionable.
Another discrepancy concerns the geographical coverage of the supposed breach. The exchange said the listing includes jurisdictions where Binance no longer operates.
The spokesperson suggested that the advertised records could resemble information collected through infostealer malware, which targets individual devices and can capture credentials or other sensitive information.
“Similar past listings have often involved infostealer malware data collected from users’ own devices rather than a breach of Binance systems,” the spokesperson said.
ShinyHunters demanded $900,000 for Binance records?
The allegations surfaced after cybersecurity monitoring account ThreatMon shared details of an underground forum listing attributed to the threat actor ShinyHunters.
According to ThreatMon, the group claimed to possess 335,900,000 lines of information associated with Binance users across approximately 170 countries.
The advertised dataset allegedly contains email addresses, telephone numbers, passwords, identification documents, transaction histories and other personal details.
ShinyHunters further claimed that the information included internal infrastructure records, private wallet keys and details concerning cryptocurrency assets held in Binance’s hot wallets.
The group demanded $900,000 in Bitcoin or Monero in exchange for the information and threatened to release the dataset if its demands were not met.
In the forum advertisement, the actor reportedly warned Binance that it had “two options left: pay or leak.”
ThreatMon said the seller had placed a sample of the purported records behind a paywall on the forum, but cautioned that the alleged breach had not been independently verified, particularly the claims concerning Binance’s hot wallets and private keys.
The cybersecurity account identified ShinyHunters as a group that had previously advertised alleged breaches involving Salesforce Data.com, Indian electronics retailer Vijay Sales and Kuwaiti government entities.
Binance’s response follows October hot wallet attack
The allegations have surfaced shortly after Binance suffered a separate, confirmed security breach on October 29, when attackers stole approximately $6.34 billion in cryptocurrency from its hot wallets.
In its November 3 incident report, Binance traced the attack to compromised employee devices, malicious software and stolen credentials that eventually allowed unauthorized access to wallet signing infrastructure.
The exchange subsequently reported that approximately $2.85 billion had been frozen or intercepted, while it used company resources to replace affected customer assets.
On November 5, Binance requested the return of 8,425.997 ETH and approximately 74.56 million ARB that had been frozen following the attack.
The earlier incident involved unauthorized cryptocurrency transfers, while the latest ShinyHunters listing alleges the theft of customer records and credentials.
Binance has separately warned customers about phishing messages that impersonate exchange security alerts and direct recipients to fraudulent websites designed to collect login information.
In its latest response, the spokesperson urged users to remain cautious of suspicious communications and avoid disclosing passwords, two-factor authentication codes, wallet seed phrases or private keys.
