Claim Surfaces on Underground Forum

A threat actor known as ShinyHunters posted a listing on a hacking forum that purported to sell 335.9 million lines of data tied to Binance users across roughly 170 countries. The material was said to include identity documents such as passports and cards, email addresses, phone numbers, account passwords, transaction histories, and internal infrastructure details. Private keys for external wallets and information about hot-wallet assets were also mentioned, with the asking price set at $900,000 in Bitcoin or Monero. The seller allegedly warned that the data would be published unless the exchange paid the sum.

Binance Investigates and Finds No Evidence

Binance reviewed the advertisement and sample records provided by the seller. The exchange identified multiple discrepancies with its actual systems and data-handling practices. It does not store user passwords in plaintext form, nor does it hold private keys for customers’ external wallets. The listed dataset also referenced jurisdictions where the platform no longer operates. Binance noted that similar past offers have frequently involved information collected by infostealer malware on individual user devices rather than any breach of its infrastructure.

A spokesperson stated that the exchange is actively investigating the claims but has found no indication of a compromise involving its systems or customer data at this stage.

Founder CZ Voices Strong Doubts

Changpeng Zhao responded to the claim on X, arguing that the seller’s offer of private keys for sale rather than their use to drain funds made the entire story untenable. He observed that media outlets had rushed to report the story for headlines despite obvious problems with the details.

Listing Shows Signs of Recycled or Fabricated Content

Security researchers from Brandefense had already flagged four near-identical versions of the advertisement appearing on Telegram accounts between late October and early November. Prices in the versions ranged from $500,000 to $900,000, with some allowing negotiation. The firm noted that 335.9 million lines of data do not automatically translate to 335.9 million affected individuals, and the inclusion of private keys and hot-wallet details remained unverified by independent means.

Context of Recent Exchange Incident

The allegation emerged days after Binance disclosed a separate $6.34 billion theft from its hot wallets on October 29. That breach involved compromised employee devices and stolen credentials, with the final unauthorized transfer of 2,961.9 ETH occurring on the same day. Binance reported freezing or intercepting roughly $2.85 billion of the stolen assets and using company funds to replace affected customer holdings. The October incident was later attributed by the FBI to North Korean actors.

Binance has also issued ongoing warnings about phishing attempts that impersonate security alerts and direct users to fraudulent sites to steal credentials.

User Guidance Remains Simple

Binance advised customers to avoid disclosing passwords, two-factor authentication codes, wallet seed phrases, or private keys through any suspicious channels. The exchange continues to monitor the situation and maintain that no customer data from its platform appears to have been exposed.