Binance Denies Alleged 335 Million-User Data Breach Linked to ShinyHunters Handle
Summary
A seller using the ShinyHunters handle offered purported records of 335 million Binance users for $900,000. Binance says it found no evidence of compromise and called the listing likely a scam, citing claims inconsistent with its data practices.
Key points
- A threat actor using the ShinyHunters handle, believed to be impersonating the extortion group, claimed to have records of 335 million Binance users and offered them for $900,000.
- The seller claimed the data included KYC documents, account passwords, wallet private keys, transaction history, emails, phone numbers, and internal infrastructure information.
- Binance said it found no evidence that its systems or the listed customer and infrastructure data had been compromised, and described the listing as likely a scam.
- Binance said it does not hold private keys for users’ external wallets, does not store passwords in plaintext, and no longer operates in some jurisdictions cited by the seller.
- Binance said similar past listings may involve infostealer data collected from users’ devices; forum users also questioned whether the offered data was legitimate.
- Binance advised customers not to share passwords, 2FA codes, seed phrases, or private keys and to remain alert for phishing.
Article Details
- Victim Organization
- Binance
- Incident Type
- Alleged data breach and extortion claim; Binance denied that its systems or data were compromised.
- Disclosure Date
- 2026-11-09
- Data Types Exposed
- Allegedly offered for sale: Know Your Customer (KYC) documents
- Allegedly offered for sale: internal infrastructure information
- Allegedly offered for sale: user account passwords
- Allegedly offered for sale: crypto wallet private keys
- Allegedly offered for sale: transaction history
- Allegedly offered for sale: email addresses
- Allegedly offered for sale: phone numbers
- Affected Records
- A forum account claimed the data involved 335 million Binance users; this has not been verified.
- Operational Impact
- No compromise or operational impact was confirmed. Binance said it found no evidence of a breach and described the listing as likely a scam.
- Ransom Or Extortion
- The account offered the purported data for $900,000 and threatened to leak it if Binance did not pay; the claim is unverified.
- Claim Status
- claimed
Threat Actors
APT38The article identifies APT38 as another tracking name for TraderTraitor, which the FBI attributed with the previously reported Binance wallet-infrastructure compromise.Jade SleetThe FBI attributed a previously reported Binance wallet-infrastructure compromise to the North Korean state-backed group TraderTraitor. The article says it is also tracked as Lazarus Group, Jade Sleet, and APT38.Lazarus GroupThe article identifies Lazarus Group as another tracking name for TraderTraitor, which the FBI attributed with the previously reported Binance wallet-infrastructure compromise.