Binance denied a new data breach claim in statements published November 9, 2026. The denial came about a week after the exchange confirmed North Korean hackers took roughly $6.34 billion in cryptocurrency from its wallets.
The Essentials
- Binance says it found no evidence that its systems, KYC data, account credentials, wallet private keys, or internal infrastructure were compromised.
- A seller using the ShinyHunters handle wants $900,000 for what it calls the records of 335 million Binance users.
- ThreatMon, a threat-intelligence firm, says the seller wants payment in Bitcoin or Monero and claims users in about 170 countries.
- The FBI has tied Binance’s confirmed theft to TraderTraitor, the North Korean state-backed group also tracked as Lazarus Group.
A confirmed hack set the stage
Binance confirmed last week that North Korean hackers tricked an employee into installing malware during a fake job interview. The attackers used that access to compromise the company’s wallet infrastructure and drain about $6.34 billion in crypto. The FBI attributed the theft to TraderTraitor, also tracked as Lazarus Group, Jade Sleet, and APT38. The same group was linked to the $1.5 billion Bybit hack in February 2025.
That theft is the backdrop for the new claim. A real compromise one week earlier makes a second one easy to believe, and a seller riding that story gets attention for free.
Binance Says Alleged 335M-User Data Leak Likely a Scam @BinanceHelpDesk said it is investigating claims that ShinyHunters stole data on 335 million users and demanded $900,000, but has found no evidence that its systems, KYC data, account credentials or wallet private keys were compromised. The exchange said parts of the listing are inconsistent with how Binance stores user data and that the dataset may instead involve infostealer data taken from users’ own devices.
— Wu Blockchain (@WuBlockchain) November 9, 2026
Binance calls the $900,000 listing a scam
The listing appeared on a newly emerged underground cybercrime forum before spreading to X. Its author is believed to be impersonating the ShinyHunters extortion gang. The seller says the haul includes KYC documents, account passwords, wallet private keys, transaction histories, emails, phone numbers, and internal infrastructure details. Binance, the post said, has “two options left: pay or leak.“
The listing advertises 335,900,000 lines of information, and nobody has confirmed that count as a number of people. One customer can fill dozens of rows with logins, deposits, and trades. At that price, the offer works out to about 0.27 cents per line. That’s a strange discount for a file that would include working wallet keys if it were real.
Binance called the offer likely a scam. It described that verdict as preliminary, based on the listing’s description and the sample data it has reviewed so far. The company said its investigation continues and pointed to specific claims that clash with how it stores data.
| What the listing claims | What Binance says |
|---|---|
| Crypto wallet private keys | It doesn’t hold private keys for users’ external wallets |
| Account passwords | It doesn’t store user passwords in plaintext |
| Users in the jurisdictions it names | It no longer operates in some of them |
| KYC files and infrastructure data | No evidence either was compromised |
The denial points to customers’ own devices
“Similar past listings have often involved infostealer malware data collected from users’ own devices rather than a breach of Binance systems,” a Binance spokesperson said in a statement. If that explanation applies here, it points the likely leak toward customers’ own machines and away from Binance’s servers.
Customers who reuse their Binance password on other sites carry the most exposure if that theory holds. A credential stolen from one device works anywhere that password does. Binance advised customers never to share passwords, 2FA codes, seed phrases, or private keys, and to stay alert for phishing and wallet-drainer attempts.
Four questions remain open:
- Who runs the account using the ShinyHunters handle, and does it have any tie to the original group?
- Did any record in the seller’s sample match a real Binance account?
- If the data came from infostealer logs, how many Binance logins does it actually contain?
- When will Binance publish the result of its investigation?
The two incidents start in different places. The confirmed theft began with malware on one employee’s machine inside Binance. Binance’s own account places the new listing alongside past sales built on data taken from customers’ own devices.
Even the forum’s own users spotted the hole in the pitch. “If you hold the private keys to all the wallets, what would be the justification for selling this?” one asked.
