Binance has rejected allegations that hackers stole information relating to approximately 335 million customers, saying its preliminary investigation found no evidence of a new systems breach and that the purported data sale is likely fraudulent.
The denial follows an underground forum listing published under the ShinyHunters name, offering what the seller described as 335.9 million records for $900,000. The advertised material allegedly includes identity verification documents, account passwords, transaction histories, cryptocurrency wallet private keys and internal infrastructure information.
In comments reported by BleepingComputer on November 9, 2026, a Binance spokesperson said the exchange had found no evidence that its systems, customer KYC records, account credentials, wallet private keys or infrastructure information were compromised in connection with the listing.
The exchange’s assessment remains preliminary. Neither the authenticity of the advertised dataset nor the seller’s connection to the established ShinyHunters hacking group has been independently confirmed.
Seller demands $900,000 for alleged Binance data
The allegations gained wider attention on November 8 after cybersecurity monitoring account ThreatMon reported an underground forum listing attributed to ShinyHunters. The seller claimed to possess 335,900,000 lines of information associated with Binance users in approximately 170 countries.
The advertisment described a collection containing email addresses, telephone numbers, passwords, identification documents, transaction histories, wallet information and internal technical records. The seller demanded payment in Bitcoin or Monero and threatened to publish the purported material if Binance refused.
The number is huge, though it is only the seller’s number.
The advertised 335.9 million lines cannot be treated as 335.9 million affected customers. A dataset may contain multiple entries for individual users, historical information, duplicated records or material collected from unrelated sources.
Earlier evidence also complicates the seller’s account. On November 3, cybersecurity company Brandefense published research identifying four versions of a similar Binance data-sale advertisement circulating between October 30 and November 2.
The advertisements appeared under three different Telegram account names with nearly identical wording. One November 1 version sought a negotiable $500,000, while two November 2 versions advertised $900,000, including one suggesting the price could fall to $500,000.
The sales pitch changed price, too, which is a little odd for a supposed single leak.
Brandefense said it had not examined or authenticated any sample of the advertised data as of November 3. Its researchers considered the mixture of customer records, private keys and infrastructure information more consistent with recycled material or a fraudulent listing than a single verified extraction.
ThreatMon separately reported that a sample was available behind a forum paywall. That arrangement has not produced publicly verified evidence demonstrating that the purported records originated from Binance’s systems.
Binance identifies inconsistencies in alleged breach
Binance’s denial rests partly on discrepancies between the seller’s description and the exchange’s stated data-handling practices.
The exchange says it does not store customers’ account passwords in plaintext. An advertisement claiming to contain readable passwords therefore raises questions about where those credentials originated and whether they are authentic Binance account data.
Binance also says it does not possess private keys belonging to customers’ external wallets. The seller’s claim to hold those keys is inconsistent with that arrangement, although the exchange’s statement does not address every possible category of wallet information.
There is the private-key claim, and then there is the rather strange decision to sell it all for $900,000.
On November 9, Binance founder Changpeng Zhao publicly dismissed the listing as fraudulent, questioning why an actor with access to usable cryptocurrency private keys would attempt to sell them rather than move the associated funds.
His criticism concerns the credibility of the advertisement rather than a technical verification of the offered records.
Binance identified another inconsistency involving geographical coverage. According to its spokesperson, the listing refers to jurisdictions where the exchange no longer operates.
The company also suggested that similar past advertisements have involved information collected through infostealer malware running on users’ devices. Such software can capture saved credentials and other sensitive information without compromising the infrastructure of the financial platform whose name appears in the stolen records.
That is a possible explanation, not an established origin for the material being advertised. The available evidence does not demonstrate that the seller obtained genuine Binance customer records through malware or any other method.
October’s $6.34 billion Binance hack is a separate case
The disputed data-sale allegation emerged shortly after a confirmed security incident involving Binance’s cryptocurrency wallet infrastructure.
On October 29, attackers stole approximately $6.34 billion in digital assets after gaining unauthorized access to the exchange’s wallet-signing systems. Binance subsequently attributed the intrusion to compromised employee devices and stolen credentials.
On October 31, the FBI attributed the theft to North Korea’s TraderTraitor operation, reporting that investigators had observed stolen cryptocurrency being converted primarily into Ether. The agency also identified blockchain addresses connected to the attack and urged cryptocurrency service providers to help disrupt subsequent laundering.
Following the theft, Binance suspended outgoing cryptocurrency transfers while conducting security checks and replenishing affected assets. The exchange began restoring withdrawals on November 1, initially reopening Bitcoin and selected other networks.
As covered in DaveFinances’ report on Binance’s withdrawal restart after the $6.3 billion hack, the company said it had replaced approximately 95% of affected token assets using corporate resources by November 1. That represented replacement of customer asset backing rather than recovery of the original stolen cryptocurrency.
And the timing is awkward: one confirmed theft, followed days later by a very different claim that has not been substantiated.
The October incident involved unauthorized cryptocurrency transfers through compromised wallet infrastructure. The latest advertisement alleges the theft of customer identity records, login information and other data. No available evidence connects the purported seller to the October attackers or establishes that the advertised records came from that incident.
The chronology also shows how assessments can change as evidence emerges. DaveFinances’ initial reporting on unusual Binance wallet transfers on October 29 distinguished screenshots showing transaction activity from proof of unauthorized asset losses. Subsequent company disclosures and the FBI’s findings established the separate wallet theft.
Unverified listing raises phishing concerns
Even without an authenticated dataset, the publicity surrounding the alleged breach creates an opportunity for criminals impersonating exchange support teams or sending fraudulent security notifications.
Binance has urged customers to avoid sharing account passwords, two-factor authentication codes, wallet seed phrases and private keys. The exchange has not identified a verified customer-data compromise associated with the advertised listing.
Recent cryptocurrency phishing investigations provide a documented example of how criminals exploit familiar exchange branding. On November 6, DaveFinances reported on counterfeit OKX websites and fraudulent cryptocurrency reward pages that attempted to direct users toward suspicious login destinations, application downloads or wallet connections.
Those campaigns have no established connection to the Binance allegation. They nevertheless demonstrate how attackers can distribute malicious infrastructure under recognised financial brands without compromising the legitimate platforms themselves.
The outstanding evidence remains fairly basic, really: a verified sample, its origin, and whether any of it belongs to actual Binance customers.
Independent examination could determine whether the purported dataset contains authentic customer information, reused credentials from unrelated breaches, duplicated records or fabricated entries. Such verification would need to establish the source and age of the information rather than relying on the advertised record count.
Binance’s preliminary findings support its position that the listing is likely fraudulent, but they do not independently establish what the seller actually possesses. The reported sample remains unverified, and the use of the ShinyHunters name has not been authenticated.
As of November 9, no independently confirmed breach of Binance customer records has emerged from the listing. The $900,000 asking price and 335.9 million-line figure remain claims made by the seller, while the exchange’s investigation continues.
Johan Shamshad is Editor-in-Chief at Dave Finances, covering financial markets, digital assets, trading platforms, brokers, fintech, payments and regulation. Since 2023, he has also worked as an editor at Gulf News, the UAE English-language newspaper published by Al Nisr Publishing LLC. His work focuses on market-moving developments, company disclosures, regulatory changes and trading infrastructure, with an emphasis on primary-source verification and practical context for traders and investors.