Binance denies breach behind ShinyHunters-branded 335M-record listing; separate $6.34bn TraderTraitor theft continues
Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 10/11/2026 12:12; os links antigos trazem para cá.
Binance says it found no evidence of compromise behind a listing, posted under the ShinyHunters handle, that offers 335 million user records for $900,000 (bleepingcomputer.com). The post appeared on the PwsForums forum on November 4 and claims KYC documents, passwords, wallet private keys, transaction history, emails, phone numbers and internal infrastructure data, with a 'pay or leak' ultimatum (infosecurity-magazine.com). Binance's customer support account calls the listing likely a scam. Its preliminary investigation points the same way, and the seller reportedly asked for Bitcoin or Monero (bleepingcomputer.com, citing crypto.news). The claim is unverified, forum members questioned whether the data is real, and the advertised line count is not a count of unique users (infosecurity-magazine.com). BleepingComputer believes the seller is impersonating the ShinyHunters extortion gang. The listing is separate from, but reported alongside, the roughly $6.34bn theft from Binance on October 29, which the FBI attributes to TraderTraitor (North Korea). That group is now laundering the proceeds through short-lived meme coins (infosecurity-magazine.com).
Detalhes técnicos
- Listing: 335.9 million lines covering private key wallets, passwords, transaction histories, emails, phone numbers, internal infrastructure, KYC material such as ID cards and passports, and 'crypto assets in Binance's hot wallet' (infosecurity-magazine.com). The price is $900,000 and the only offer is 'pay or leak' (infosecurity-magazine.com, bleepingcomputer.com). BleepingComputer describes the forum as newly emerged (bleepingcomputer.com).
- Binance's counter-evidence: it does not store passwords in plaintext, does not hold private keys for users' external wallets, and no longer operates in some jurisdictions the seller cited, so parts of the listing conflict with its data handling (bleepingcomputer.com, infosecurity-magazine.com).
- Binance's assessment of the data source: similar past listings were built from infostealer malware data collected on users' own devices, not from breaches of its systems (bleepingcomputer.com, infosecurity-magazine.com). This is the company's own view and is not independently verified.
- Theft context: Binance says a software engineer was lured through a fake job interview and installed a 'malicious code repository' carrying zero-day malware that its endpoint tools missed. The attackers then compromised the wallet infrastructure (bleepingcomputer.com, as relayed by infosecurity-magazine.com). The FBI links the theft to TraderTraitor, also tracked as Lazarus Group, Jade Sleet and APT38 (bleepingcomputer.com).
Remediação
- Binance advises users never to share passwords, 2FA codes, seed phrases or private keys, and to treat unsolicited contact asking for them as phishing (bleepingcomputer.com, infosecurity-magazine.com).
- Analyst recommendations, not statements from the sources: check endpoints for infostealer infections, rotate credentials and reset 2FA for any account suspected of exposure, and watch for fake Binance support accounts and abuse of the ShinyHunters brand. Treat unsolicited job offers that require running a coding test as hostile.
- The sources name no CVE and no vendor patch for the zero-day used in the theft, so no fixed version can be cited.
Relatos divergentes
- Attribution: infosecurity-magazine.com attributes the listing to ShinyHunters. bleepingcomputer.com reports that the seller is believed to be impersonating the gang. The ShinyHunters link should therefore be read as claimed, not confirmed.
- Record count: bleepingcomputer.com gives 335 million records. The later infosecurity-magazine.com gives 335.9 million lines and notes that this is not a count of unique users.
- Severity: bleepingcomputer.com rates the listing medium because it is unconfirmed and denied by the vendor. infosecurity-magazine.com rates it high because of the confirmed theft and ongoing laundering. Neither source reports a confirmed compromise behind the listing.
Linha do tempo
-
Binance disputes ShinyHunters' 335M-record leak claim as likely scam amid TraderTraitor laundering
ler a análise desta fonte ocultar
Binance is investigating a listing attributed to ShinyHunters that offers 335.9 million records for $900,000, including wallet private keys, passwords and KYC documents. The exchange's customer support account calls the listing likely a scam, having found no sign that its systems, KYC data, credentials or wallet keys were compromised, and it links similar past listings to infostealer malware on users' devices. The claim is unverified, and the advertised line count is not a count of unique users. The larger threat is the TraderTraitor theft of about $6.34bn from Binance on October 29, which the FBI attributes to North Korea and which was carried out through a fake job interview and zero-day malware; the group is now laundering the proceeds through short-lived meme coins. Criticity is high rather than critical: the extortion claim has no confirmed compromise behind it, but the confirmed theft and the ongoing laundering matter to any defender of crypto platforms.
Technical Details
- Listing: posted on PwsForums on November 4, advertising 335.9 million lines covering private key wallets, user passwords, transaction histories, emails, phone numbers, internal infrastructure, KYC material such as ID cards and passports, and 'crypto assets in Binance's hot wallet' (article). The seller demanded $900,000 and offered only 'pay or leak' (article). BleepingComputer describes the forum as newly emerged and the seller as believed to impersonate ShinyHunters (bleepingcomputer.com).
- Binance's counter-evidence: Binance says it does not store user passwords in plaintext, does not hold private keys for external wallets, and no longer operates in some of the jurisdictions the listing names (article; bleepingcomputer.com).
- Theft context: Binance says a software engineer was lured through a fake job interview and installed a 'malicious code repository' carrying zero-day malware that its endpoint tools missed, after which the attackers compromised the wallet infrastructure (bleepingcomputer.com). The FBI links the theft to TraderTraitor, also tracked as Lazarus Group, Jade Sleet and APT38 (bleepingcomputer.com).
Remediation
- Binance advises users never to share passwords, 2FA codes, seed phrases or private keys, and to stay alert to phishing (bleepingcomputer.com; article).
- Analyst recommendation: treat unsolicited job offers that require running a coding test as hostile, check employee devices for infostealer infections, and reset credentials and 2FA for any account suspected of exposure. The sources reviewed name no CVE and no vendor patch for the zero-day used in the theft, so no fixed version can be cited.
Conflicting Reports
- The article attributes the listing to ShinyHunters. BleepingComputer (bleepingcomputer.com) reports that the seller is believed to impersonate the ShinyHunters extortion gang, so the ShinyHunters attribution should be read as the claimed one, not a confirmed one.
- The article gives the theft as around $6.3bn. BleepingComputer (bleepingcomputer.com) gives about $6.34bn; the difference is rounding, not a disagreement about the event.
-
Binance denies breach behind alleged ShinyHunters listing of 335 million user records
ler a análise desta fonte ocultar
Binance has rejected claims of a new breach after a seller using the ShinyHunters handle listed what it said were records of 335 million users on an underground forum for $900,000 (bleepingcomputer.com). The seller is believed to be impersonating the ShinyHunters extortion gang, and the listing claims KYC documents, passwords, private keys, transaction history and internal infrastructure data. Binance told BleepingComputer it found no evidence of compromise and considers the listing likely a scam (bleepingcomputer.com). Its preliminary investigation points the same way, and the seller reportedly asked for payment in Bitcoin or Monero (crypto.news). The claim remains unverified, and forum members also questioned whether the data is legitimate (bleepingcomputer.com). Criticity is medium: the listing is unconfirmed and the vendor denies it, but exposure of credentials and wallet keys would be serious if real, and the claim invites phishing against users. It is separate from the roughly $6.3 billion Binance hot-wallet theft of October 2026, which the FBI attributed to TraderTraitor and which is background only.
Technical Details
- The listing claims 335 million records including KYC documents, account passwords, crypto wallet private keys, transaction history, emails and phone numbers, with a 'pay or leak' ultimatum (bleepingcomputer.com).
- Binance says it does not hold private keys for users' external wallets, does not store passwords in plaintext, and no longer operates in some jurisdictions the seller cited, so parts of the listing conflict with its data handling (bleepingcomputer.com).
- Binance says similar past listings were built from infostealer malware data collected on users' own devices rather than from breaches of its systems (bleepingcomputer.com). This is the company's own assessment and has not been independently verified.
- Background: the FBI attributed the theft of about $6.34 billion in cryptocurrency from Binance to TraderTraitor, also tracked as Lazarus Group, Jade Sleet and APT38 (bleepingcomputer.com article under analysis). The earlier hot-wallet theft is not the subject of this listing.
Remediation
- Users should never share passwords, 2FA codes, seed phrases or private keys, and should treat unsolicited contact asking for them as phishing (bleepingcomputer.com).
- Defenders should check endpoints for infostealer infections, rotate credentials that may have been exposed on affected devices, and watch for fake Binance support accounts and impersonation of the ShinyHunters brand. These are analyst recommendations, not statements from the sources.