Binance says no evidence of breach after ShinyHunters claims 335 million user records

Binance said on Nov. 9, 2026 that a preliminary review of its systems turned up no evidence of a compromise involving customer data after a threat actor using the ShinyHunters handle advertised records of 335 million users for sale on an underground cybercrime forum.

The listing offered 335,900,000 lines of data allegedly tied to Binance users across 170 countries, and the seller demanded $900,000 in Bitcoin or Monero with an ultimatum: pay or leak. The advertised file supposedly contained KYC documents, passwords, private keys for wallets, transaction histories, email addresses, phone numbers, internal infrastructure details and information about hot-wallet assets. Forum participants doubted the data was legitimate and asked why anyone holding private keys would sell the information instead of moving funds. ThreatMon reported the payment terms and country scope, and said the seller placed a sample behind a paywall without independent verification.

CoinLaw said the advertised line count has not been verified as a count of affected users, since one customer can produce dozens of rows. BreachHistory said the exchange’s About page has previously pointed to roughly 250 million registered users in an earlier year, making the advertised figure larger than the exchange’s acknowledged base. Brandefense saw similar ads move through Telegram from Oct. 30 to Nov. 2, 2026, with asking prices moving between $500,000 and $900,000, and said it had neither verified the data nor tested a sample. CoinLaw said the claim surfaced on a newly emerged underground forum and then moved to X.

Security researcher Jeremiah Fowler found an exposed database holding roughly 149 million usernames and passwords, including around 420,000 credentials tied to Binance that were probably gathered by infostealer malware, software that steals information from devices. The finding did not establish that anyone breached Binance’s systems.

Binance said its review rested on the listing description and sample information examined so far, and that it uncovered no proof of compromise involving account credentials, wallet private keys or internal infrastructure information. The exchange pointed to inconsistencies: it does not store user passwords in plaintext, it holds no private keys for customers’ external wallets, and the listing cited jurisdictions where Binance no longer operates. Binance suggested the advertised data might look like information gathered by infostealer malware on customers’ own machines instead of a breach of its own systems, pointing to similar past listings. A Binance spokesperson said that earlier listings of this kind have drawn on infostealer data harvested from customer devices instead of from a Binance breach.

On Nov. 8, 2026, Binance’s support account on X said the exchange knew about the claims and was looking into them. On Nov. 9, 2026, CZ called the offer a scam on X, writing “This is obviously fake/scam.” The exchange described the claim as likely a scam and characterized its investigation as preliminary and ongoing. Binance confirmed that North Korean hackers duped an employee into installing malware through a fake job interview, but said it has not confirmed any connection between that October 29 incident and the ShinyHunters listing.

Reports from Binance and outlets including BleepingComputer and CoinLaw said the separate confirmed incident began on Oct. 29, 2026, when unauthorized transfers moved from Binance hot wallets after attackers compromised wallet infrastructure. The theft totaled roughly $6.34 billion in cryptocurrency, and the outlets reported that the group was connected to the February 2025 Bybit hack that involved $1.5 billion. The FBI attributed the theft to TraderTraitor, a North Korean state-backed group also tracked as Lazarus Group, Jade Sleet and APT38. Binance’s November 3 incident report traced the attack to compromised employee devices, malicious software and stolen credentials that allowed unauthorized access to wallet signing infrastructure.

The October 29 theft began with malware on one employee’s machine inside Binance, including a compromised DevOps laptop, and freeze or interception had reached roughly $2.85 billion. The November 3 incident report stated that the incident affected roughly $6.34 billion in digital assets and that about $2.85 billion faced freeze or interception when Binance issued the update. On Nov. 5, Binance requested the return of frozen holdings totaling 8,425.997 ETH and 74.56 million ARB. The exchange pledged to cover losses from stolen assets, planned an independent cybersecurity review, used its own resources to make affected customers whole for assets held in affected hot wallets, and said it is recovering user funds.

The exchange has not confirmed a link between the October 29 incident and the ShinyHunters listing. BreachHistory said a separate forum listing from April 2026 claimed about 1.5 million alleged Binance leads and remains unverified. No one has independently established the authenticity or provenance of the advertised dataset.

CoinLaw lists four open questions about the claim: who operates the account using the ShinyHunters name and whether it connects to the original group, whether any record in the seller’s sample matched a genuine Binance account, how many Binance logins the data holds if it came from infostealer logs, and when Binance will release the findings of its investigation. Shattered says proof of genuine data would include records tied to real, verifiable accounts with details only an insider system would contain, letting independent researchers confirm matches without exposing individuals, though nothing in the coverage shows this occurred. Binance could strengthen its position by issuing a fuller technical explanation or sharing findings with respected outside analysts, but it had not done so according to the reporting reviewed. Shattered also cautioned that an initial review might overlook issues, particularly if an intruder compromised a third-party vendor instead of the exchange itself.

Shattered details concrete harms from scam listings even when no one took Binance data, such as panicked withdrawals, phishing pitches offering to help secure accounts within hours, fraud against buyers and damage to the exchange’s reputation. A fabricated breach listing may stitch together old, public or recycled data from unrelated sources, duplicate rows or create plausible-looking records, leaving buyers to trust the seller without inspecting the full file. None of the outlets reviewed by Shattered reported a measurable price reaction tied to the claim.

Binance told customers never to share passwords, 2FA codes, seed phrases or private keys and to remain alert to phishing attempts. The exchange also told users to create a unique strong password, turn on two-factor authentication through an authenticator app or hardware security key, switch on address allowlisting and anti-phishing codes, and check account activity for unfamiliar devices or withdrawal addresses. Binance’s security directorate urged two-factor authentication and vigilance against phishing campaigns that exploit the uncertainty generated by such announcements. The exchange also warned customers about phishing messages that copy security alerts from Binance and send people to fake websites meant to steal login information.