Binance calls ShinyHunters’ alleged 335 million user data breach a likely scam

31Importance
closedStatus
3News media
Published
Updated

Binance and its founder rejected an online claim that 335 million user records had been stolen, with both saying the listing looked fake or scam-like. The exchange also said its early review found no technical signs of compromise, while the alleged seller’s $900,000 ask for identity documents, credentials and private keys drew suspicion.

Key claims & sources

✓
Binance said it was investigating allegations that circulated online about a supposed breach involving 335 million user records.
✓
Binance said its preliminary review suggested the data listing was likely a scam.
✓
Binance said its preliminary review found no technical evidence of weaknesses in its internal systems, KYC databases or private keys.
✓
The exchange said the underground listing offered 335.9 million user records for $900,000 and mentioned identity documents, credentials and private keys.

What it means

ShinyHunters is a known extortion-driven hacking brand tied to the 2024 Snowflake-linked breaches that hit AT&T and Ticketmaster, where stolen corporate data was auctioned on dark-web forums. Binance, the largest exchange by volume, has weathered past security scares and a 2023 settlement with U.S. authorities over compliance failures, making any breach claim against it carry outsized weight regardless of its truth.

Users are told to treat the listing as unverified rather than change passwords or move funds in panic, since Binance's preliminary scan found no gaps in KYC databases or private-key storage. Security teams and competing exchanges will still want to watch for leaked credentials circulating elsewhere, because even a fabricated listing can seed real credential-stuffing attempts against accounts that reuse passwords.

CZ's point that a genuine holder of 335 million private keys would drain wallets rather than sell data for $900,000 exposes the economics of the dark-web extortion market: scarcity claims are often cheaper to fake than to monetize honestly. The episode also shows exchanges policing their own breach narratives, which is useful for speed but leaves outside verification, the thing that would actually settle the question, absent.

The Defiant's reporting on inconsistencies in the $900,000 listing points to where this resolves: independent cybersecurity researchers or dark-web monitors confirming or debunking the record sample, not Binance's own statement. A credible third-party match of even a fraction of the 335.9 million records to real user data would reopen the case; silence from outside researchers in the coming days will likely close it as noise.

Market reaction i

BNBBNB it is the asset of the company or protocol in the event

BNB rose 0.4% in the 4 hours after the first headline, after a flat 2 hours before.

$680.59 price at the headline
0.0% 2 h before
+0.4% 4 h after
+1.0% 12 h after
First headline

47 prices, one every 30 minutes

Coverage timeline

Every piece in order, with the time its news medium declares — if it is not believable we use ours and say so — and what it added to what was already known at that point. Arriving first is not the same as adding something.

first
Nov 9 08:34
+12 min
Nov 9 08:47
The Defiant context
Its angle: inconsistencies, credentials, purported
+9 h 10 m
Nov 9 17:45
crypto.news adds
Brings into the story: CZ, with quotes
+15 h 4 m
Nov 9 23:38
Crypto Economy context
Its angle: representatives, vulnerabilities, categorically; with quotes

Other recent incidents

WhenWhat happenedFigure
2 days ago Initia · Private key leak incident $615k
3 days ago Arcus · Accounting bug incident $2.2M
3 days ago Ankr Bridge · Cross-Chain Message Spoofing incident $304.5k
4 days ago LNbits · Unknown incident no figure in dollars
4 days ago ACryptoS · Missing Input Validation incident $665.4k

4300 incidents stored