Binance calls alleged ShinyHunters data leak listing a likely scam
Binance says its initial review found no sign its systems were breached, and calls a $900,000 hacking-forum data listing a likely scam while it keeps investigating.
Binance says a hacking-forum listing that claims to sell user data from the exchange is most likely a scam. The Defiant, The Cryptonomist and Wu Blockchain all reported the exchange's position. According to The Cryptonomist, Binance's customer-support account published its assessment on November 8, 2026, and the exchange is still investigating.
Binance said its review so far found no evidence that its systems or customer information were compromised. Wu Blockchain, citing the @BinanceHelpDesk account, said the exchange found no sign of exposure of KYC data, account credentials or wallet private keys.
What the listing claims
ThreatMon, a cybersecurity monitoring firm, reported the advertisement, according to The Cryptonomist. The post is attributed to ShinyHunters and offers 335,900,000 lines of information said to cover Binance users in about 170 countries. The seller wants $900,000 in Bitcoin or Monero and has threatened to publish the data if Binance does not pay, ThreatMon said.
The listing says the data includes email addresses, phone numbers, passwords, identity cards or passports, and transaction histories. It also claims to hold wallet private keys, internal infrastructure details and information on assets in Binance's hot wallets.
The outlets describe the scale differently. Wu Blockchain's summary refers to data on 335 million users. The Cryptonomist stresses that the advertised line count is not a confirmed number of affected people.
Why Binance doubts it
Binance pointed to contradictions between the listing and its own practices, according to The Cryptonomist. The exchange said it does not store passwords in plaintext and does not hold private keys for users' external wallets. It also said the listing names jurisdictions where it no longer operates.
Binance's support account noted that similar past advertisements involved data gathered by infostealer malware on users' own devices, The Cryptonomist reported. Wu Blockchain said Binance suggested the dataset may be of that kind. That would mean the data came from individual users' devices, not from a breach of Binance's systems. Neither source says Binance has confirmed this explanation.
The Defiant reported that Binance cited inconsistencies in the listing, which sought $900,000 for purported identity documents, credentials and private keys. The excerpts available did not give further detail.
What remains unresolved
Binance has called its findings an initial review, and the investigation is ongoing. The sources do not say whether the seller has provided samples or whether any data has been published. They also do not say whether the seller has set a deadline for payment.
The sources do not say whether ThreatMon has updated its report since Binance's response. They also do not say whether Binance plans to publish further findings. For now, the claim comes from an anonymous forum listing, and the denial comes from Binance itself.
Sources
- Binance Says 335.9 Million-Record Breach Claim Is Likely a Scam The Defiant
- Binance data breach claim over 335.9 million lines is likely a scam, exchange says The Cryptonomist
- Binance Says Alleged 335M-User Data Leak Likely a Scam Wu Blockchain
Written with AI assistance from the sources above and checked against them. Not investment advice.