Binance calls $900K listing of 335.9M user records a likely scam

Binance is calling a $900,000 data listing a hustle. Its official customer-support account said on Nov. 8 that it found no evidence its systems, customer identity-verification data, account credentials, wallet private keys or internal infrastructure were compromised in connection with the listing. A spokesperson told crypto.news the offer “appears likely to be a scam rather than evidence of a Binance systems breach.”

The listing surfaced via cybersecurity monitoring firm ThreatMon, which said it was attributed to ShinyHunters and advertised 335,900,000 lines of information covering users in about 170 countries. The seller demanded $900,000 in Bitcoin or Monero and threatened to dump the data if Binance didn't pay, according to ThreatMon. The alleged haul includes email addresses, phone numbers, passwords, ID cards or passports and transaction histories — plus claims of internal infrastructure details, wallet private keys and data on assets in Binance's hot wallets. None of that is verified, and the advertised line count is not a confirmed number of affected people.

Binance listed its own red flags. It says it doesn't store passwords in plaintext and doesn't hold private keys for users' external wallets, and it noted the listing references jurisdictions where it no longer operates. Similar past listings, its support account said, turned out to be information pulled off users' own devices by malware rather than lifted from Binance's systems.

ThreatMon said the seller parked a sample behind a forum paywall and described the alleged breach as unverified. On Nov. 3, Brandefense's research team said it had reviewed four versions of related Telegram advertisements without opening or testing any sample, and judged the mix of identity documents, wallet keys and infrastructure details to look more like recycled data or a con than one clean extraction. It couldn't say whether any real Binance data sat behind the ads.

The data claim is a different headache from Binance's wallet attack. In its Nov. 3 incident report, the exchange said attackers slipped into an internal wallet-signing service and fired off transfers outside its normal withdrawal process, affecting roughly $6.34 billion in digital assets. Binance traced that one through compromised employee computers and stolen credentials.

Binance's support account told users to stay sharp on phishing and never hand over passwords, two-factor authentication codes, seed phrases or private keys.