Binance shrugs off ShinyHunters' 335M-record theft claim as likely scam

Binance isn't buying ShinyHunters' story. The exchange said its preliminary review of a claimed 335 million-record user data theft found no sign that its systems or customer data were touched, calling the listing likely a scam. A spokesperson told crypto.news the company is digging into claims spread on a hacking forum and on X after an initial pass turned up nothing pointing to a fresh compromise.

The threat actor's pitch is loud. According to cybersecurity monitoring account ThreatMon, ShinyHunters claimed to hold 335,900,000 lines of Binance user information spanning roughly 170 countries, packing email addresses, phone numbers, passwords, ID documents and transaction histories. The group also said the haul included internal infrastructure records, private wallet keys and details on crypto held in Binance's hot wallets, and demanded $900,000 in Bitcoin or Monero with a warning that Binance had two options: pay or leak. ThreatMon noted the sample sat behind a forum paywall and that the claims, especially the hot wallet and private key parts, hadn't been independently verified.

Binance picked the listing apart. The exchange doesn't store user passwords in plaintext, it doesn't hold private keys for customers' external wallets, and the dataset supposedly covers jurisdictions where Binance no longer operates. Its spokesperson said the material resembles data harvested by infostealer malware that targets individual devices, adding that similar past listings typically traced back to users' own compromised hardware rather than a Binance breach.

The noise lands weeks after a real one. On October 29, attackers stole about $6.34 billion in crypto from Binance hot wallets, a breach the exchange detailed in a November 3 incident report tying it to compromised employee devices, malicious software and stolen credentials that unlocked wallet signing infrastructure. Binance said roughly $2.85 billion was frozen or intercepted and that it used company funds to replace affected customer assets, then on November 5 asked for the return of 8,425.997 ETH and about 74.56 million ARB frozen after the attack.

ShinyHunters has form, according to ThreatMon, which linked the group to previously advertised breaches at Salesforce Data.com, Indian electronics retailer Vijay Sales and Kuwaiti government entities. Binance's spokesperson urged users to stay wary of suspicious messages and to never hand over passwords, two-factor authentication codes, wallet seed phrases or private keys — advice that follows separate warnings from the exchange about phishing notes posing as its own security alerts.