Binance disputes ShinyHunters' 335M-record leak claim as likely scam amid TraderTraitor laundering
Binance is investigating a listing attributed to ShinyHunters that offers 335.9 million records for $900,000, including wallet private keys, passwords and KYC documents. The exchange's customer support account calls the listing likely a scam, having found no sign that its systems, KYC data, credentials or wallet keys were compromised, and it links similar past listings to infostealer malware on users' devices. The claim is unverified, and the advertised line count is not a count of unique users. The larger threat is the TraderTraitor theft of about $6.34bn from Binance on October 29, which the FBI attributes to North Korea and which was carried out through a fake job interview and zero-day malware; the group is now laundering the proceeds through short-lived meme coins. Criticity is high rather than critical: the extortion claim has no confirmed compromise behind it, but the confirmed theft and the ongoing laundering matter to any defender of crypto platforms.
Detalhes técnicos
- Listing: posted on PwsForums on November 4, advertising 335.9 million lines covering private key wallets, user passwords, transaction histories, emails, phone numbers, internal infrastructure, KYC material such as ID cards and passports, and 'crypto assets in Binance's hot wallet' (article). The seller demanded $900,000 and offered only 'pay or leak' (article). BleepingComputer describes the forum as newly emerged and the seller as believed to impersonate ShinyHunters (bleepingcomputer.com).
- Binance's counter-evidence: Binance says it does not store user passwords in plaintext, does not hold private keys for external wallets, and no longer operates in some of the jurisdictions the listing names (article; bleepingcomputer.com).
- Theft context: Binance says a software engineer was lured through a fake job interview and installed a 'malicious code repository' carrying zero-day malware that its endpoint tools missed, after which the attackers compromised the wallet infrastructure (bleepingcomputer.com). The FBI links the theft to TraderTraitor, also tracked as Lazarus Group, Jade Sleet and APT38 (bleepingcomputer.com).
Remediação
- Binance advises users never to share passwords, 2FA codes, seed phrases or private keys, and to stay alert to phishing (bleepingcomputer.com; article).
- Analyst recommendation: treat unsolicited job offers that require running a coding test as hostile, check employee devices for infostealer infections, and reset credentials and 2FA for any account suspected of exposure. The sources reviewed name no CVE and no vendor patch for the zero-day used in the theft, so no fixed version can be cited.
Relatos divergentes
- The article attributes the listing to ShinyHunters. BleepingComputer (bleepingcomputer.com) reports that the seller is believed to impersonate the ShinyHunters extortion gang, so the ShinyHunters attribution should be read as the claimed one, not a confirmed one.
- The article gives the theft as around $6.3bn. BleepingComputer (bleepingcomputer.com) gives about $6.34bn; the difference is rounding, not a disagreement about the event.
Linha do tempo
-
Binance disputes ShinyHunters' 335M-record leak claim as likely scam amid TraderTraitor laundering
ler a análise desta fonte ocultar
Binance is investigating a listing attributed to ShinyHunters that offers 335.9 million records for $900,000, including wallet private keys, passwords and KYC documents. The exchange's customer support account calls the listing likely a scam, having found no sign that its systems, KYC data, credentials or wallet keys were compromised, and it links similar past listings to infostealer malware on users' devices. The claim is unverified, and the advertised line count is not a count of unique users. The larger threat is the TraderTraitor theft of about $6.34bn from Binance on October 29, which the FBI attributes to North Korea and which was carried out through a fake job interview and zero-day malware; the group is now laundering the proceeds through short-lived meme coins. Criticity is high rather than critical: the extortion claim has no confirmed compromise behind it, but the confirmed theft and the ongoing laundering matter to any defender of crypto platforms.
Technical Details
- Listing: posted on PwsForums on November 4, advertising 335.9 million lines covering private key wallets, user passwords, transaction histories, emails, phone numbers, internal infrastructure, KYC material such as ID cards and passports, and 'crypto assets in Binance's hot wallet' (article). The seller demanded $900,000 and offered only 'pay or leak' (article). BleepingComputer describes the forum as newly emerged and the seller as believed to impersonate ShinyHunters (bleepingcomputer.com).
- Binance's counter-evidence: Binance says it does not store user passwords in plaintext, does not hold private keys for external wallets, and no longer operates in some of the jurisdictions the listing names (article; bleepingcomputer.com).
- Theft context: Binance says a software engineer was lured through a fake job interview and installed a 'malicious code repository' carrying zero-day malware that its endpoint tools missed, after which the attackers compromised the wallet infrastructure (bleepingcomputer.com). The FBI links the theft to TraderTraitor, also tracked as Lazarus Group, Jade Sleet and APT38 (bleepingcomputer.com).
Remediation
- Binance advises users never to share passwords, 2FA codes, seed phrases or private keys, and to stay alert to phishing (bleepingcomputer.com; article).
- Analyst recommendation: treat unsolicited job offers that require running a coding test as hostile, check employee devices for infostealer infections, and reset credentials and 2FA for any account suspected of exposure. The sources reviewed name no CVE and no vendor patch for the zero-day used in the theft, so no fixed version can be cited.
Conflicting Reports
- The article attributes the listing to ShinyHunters. BleepingComputer (bleepingcomputer.com) reports that the seller is believed to impersonate the ShinyHunters extortion gang, so the ShinyHunters attribution should be read as the claimed one, not a confirmed one.
- The article gives the theft as around $6.3bn. BleepingComputer (bleepingcomputer.com) gives about $6.34bn; the difference is rounding, not a disagreement about the event.