Binance calls ShinyHunters’ alleged 335 million user data breach a likely scam
- Published
- Updated
Binance and its founder rejected an online claim that 335 million user records had been stolen, with both saying the listing looked fake or scam-like. The exchange also said its early review found no technical signs of compromise, while the alleged seller’s $900,000 ask for identity documents, credentials and private keys drew suspicion.
Key claims & sources
What it means
ShinyHunters is a known extortion-driven hacking brand tied to the 2024 Snowflake-linked breaches that hit AT&T and Ticketmaster, where stolen corporate data was auctioned on dark-web forums. Binance, the largest exchange by volume, has weathered past security scares and a 2023 settlement with U.S. authorities over compliance failures, making any breach claim against it carry outsized weight regardless of its truth.
Users are told to treat the listing as unverified rather than change passwords or move funds in panic, since Binance's preliminary scan found no gaps in KYC databases or private-key storage. Security teams and competing exchanges will still want to watch for leaked credentials circulating elsewhere, because even a fabricated listing can seed real credential-stuffing attempts against accounts that reuse passwords.
CZ's point that a genuine holder of 335 million private keys would drain wallets rather than sell data for $900,000 exposes the economics of the dark-web extortion market: scarcity claims are often cheaper to fake than to monetize honestly. The episode also shows exchanges policing their own breach narratives, which is useful for speed but leaves outside verification, the thing that would actually settle the question, absent.
The Defiant's reporting on inconsistencies in the $900,000 listing points to where this resolves: independent cybersecurity researchers or dark-web monitors confirming or debunking the record sample, not Binance's own statement. A credible third-party match of even a fraction of the 335.9 million records to real user data would reopen the case; silence from outside researchers in the coming days will likely close it as noise.
Market reaction i
BNB rose 0.4% in the 4 hours after the first headline, after a flat 2 hours before.
47 prices, one every 30 minutes
Coverage timeline
Every piece in order, with the time its news medium declares — if it is not believable we use ours and say so — and what it added to what was already known at that point. Arriving first is not the same as adding something.
Other recent incidents
| When | What happened | Figure |
|---|---|---|
| 2 days ago | Initia · Private key leak incident | $615k |
| 3 days ago | Arcus · Accounting bug incident | $2.2M |
| 3 days ago | Ankr Bridge · Cross-Chain Message Spoofing incident | $304.5k |
| 4 days ago | LNbits · Unknown incident | no figure in dollars |
| 4 days ago | ACryptoS · Missing Input Validation incident | $665.4k |
4300 incidents stored