Binance denies breach behind alleged ShinyHunters listing of 335 million user records
Binance has rejected claims of a new breach after a seller using the ShinyHunters handle listed what it said were records of 335 million users on an underground forum for $900,000 (bleepingcomputer.com). The seller is believed to be impersonating the ShinyHunters extortion gang, and the listing claims KYC documents, passwords, private keys, transaction history and internal infrastructure data. Binance told BleepingComputer it found no evidence of compromise and considers the listing likely a scam (bleepingcomputer.com). Its preliminary investigation points the same way, and the seller reportedly asked for payment in Bitcoin or Monero (crypto.news). The claim remains unverified, and forum members also questioned whether the data is legitimate (bleepingcomputer.com). Criticity is medium: the listing is unconfirmed and the vendor denies it, but exposure of credentials and wallet keys would be serious if real, and the claim invites phishing against users. It is separate from the roughly $6.3 billion Binance hot-wallet theft of October 2026, which the FBI attributed to TraderTraitor and which is background only.
Detalhes técnicos
- The listing claims 335 million records including KYC documents, account passwords, crypto wallet private keys, transaction history, emails and phone numbers, with a 'pay or leak' ultimatum (bleepingcomputer.com).
- Binance says it does not hold private keys for users' external wallets, does not store passwords in plaintext, and no longer operates in some jurisdictions the seller cited, so parts of the listing conflict with its data handling (bleepingcomputer.com).
- Binance says similar past listings were built from infostealer malware data collected on users' own devices rather than from breaches of its systems (bleepingcomputer.com). This is the company's own assessment and has not been independently verified.
- Background: the FBI attributed the theft of about $6.34 billion in cryptocurrency from Binance to TraderTraitor, also tracked as Lazarus Group, Jade Sleet and APT38 (bleepingcomputer.com article under analysis). The earlier hot-wallet theft is not the subject of this listing.
Remediação
- Users should never share passwords, 2FA codes, seed phrases or private keys, and should treat unsolicited contact asking for them as phishing (bleepingcomputer.com).
- Defenders should check endpoints for infostealer infections, rotate credentials that may have been exposed on affected devices, and watch for fake Binance support accounts and impersonation of the ShinyHunters brand. These are analyst recommendations, not statements from the sources.
Linha do tempo
-
Binance denies breach behind alleged ShinyHunters listing of 335 million user records
ler a análise desta fonte ocultar
Binance has rejected claims of a new breach after a seller using the ShinyHunters handle listed what it said were records of 335 million users on an underground forum for $900,000 (bleepingcomputer.com). The seller is believed to be impersonating the ShinyHunters extortion gang, and the listing claims KYC documents, passwords, private keys, transaction history and internal infrastructure data. Binance told BleepingComputer it found no evidence of compromise and considers the listing likely a scam (bleepingcomputer.com). Its preliminary investigation points the same way, and the seller reportedly asked for payment in Bitcoin or Monero (crypto.news). The claim remains unverified, and forum members also questioned whether the data is legitimate (bleepingcomputer.com). Criticity is medium: the listing is unconfirmed and the vendor denies it, but exposure of credentials and wallet keys would be serious if real, and the claim invites phishing against users. It is separate from the roughly $6.3 billion Binance hot-wallet theft of October 2026, which the FBI attributed to TraderTraitor and which is background only.
Technical Details
- The listing claims 335 million records including KYC documents, account passwords, crypto wallet private keys, transaction history, emails and phone numbers, with a 'pay or leak' ultimatum (bleepingcomputer.com).
- Binance says it does not hold private keys for users' external wallets, does not store passwords in plaintext, and no longer operates in some jurisdictions the seller cited, so parts of the listing conflict with its data handling (bleepingcomputer.com).
- Binance says similar past listings were built from infostealer malware data collected on users' own devices rather than from breaches of its systems (bleepingcomputer.com). This is the company's own assessment and has not been independently verified.
- Background: the FBI attributed the theft of about $6.34 billion in cryptocurrency from Binance to TraderTraitor, also tracked as Lazarus Group, Jade Sleet and APT38 (bleepingcomputer.com article under analysis). The earlier hot-wallet theft is not the subject of this listing.
Remediation
- Users should never share passwords, 2FA codes, seed phrases or private keys, and should treat unsolicited contact asking for them as phishing (bleepingcomputer.com).
- Defenders should check endpoints for infostealer infections, rotate credentials that may have been exposed on affected devices, and watch for fake Binance support accounts and impersonation of the ShinyHunters brand. These are analyst recommendations, not statements from the sources.