Binance denies breach after a 'ShinyHunters' seller lists data on 335 million users for ...

The seller claims KYC documents, passwords, wallet private keys, transaction histories, emails and phone numbers for 335 million users, priced at $900,000 [1] .

Binance says it found no evidence of a breach and that similar listings have usually been infostealer data taken from users' own devices [1] .

Binance has denied a new data breach claim from a threat actor using the "ShinyHunters" handle on a newly emerged underground cybercrime forum, BleepingComputer reported on Monday [1] . The seller is offering what it says are records belonging to 335 million Binance users for $900,000 and reportedly told the exchange it had "two options left: pay or leak" [1] . The actor is believed to be impersonating the ShinyHunters extortion gang [1] .

The listing claims KYC documents, internal infrastructure information, account passwords, crypto wallet private keys, transaction history, email addresses and phone numbers [1] . Other forum users were skeptical; one asked why anyone holding working wallet private keys would sell them instead of using them [1] .

A Binance spokesperson told BleepingComputer it had "found no evidence" that its systems, customer KYC data, account credentials, wallet keys or internal infrastructure were compromised, and called the listing likely a scam [1] . "Similar past listings have often involved infostealer malware data collected from users' own devices," the company said, adding that it does not hold private keys for users' external wallets, does not store passwords in plaintext and no longer operates in some jurisdictions the seller cited [1] .

A pattern of claims, weeks after a real theft

Binance has rebutted similar sales before. In September 2024 it denied that a forum poster called "FireBear" held personal data on 12.8 million of its users, saying its security team had confirmed it was not a Binance leak [2] .

This claim lands while the exchange is still dealing with a genuine intrusion. Binance confirmed last week that North Korean hackers tricked an employee into installing malware during a fake job interview, leading to the theft of $6.34 billion in crypto; the FBI attributed it to the group tracked as TraderTraitor, or Lazarus [1] ( MLQ coverage ). Its CFO, Kaiser Ng, stepped down days later ( MLQ coverage ). Binance told customers never to passwords, 2FA codes, seed phrases or private keys and to watch for phishing [1] .