Binance says ShinyHunters’ claim to have stolen 335 million user records is more likely a scam, and it has found no evidence of a system breach
From November 8 to 9, 2026, the hacker group ShinyHunters claimed on underground forums that it had stolen about 335.9 million rows of Binance user data, covering users from about 170 countries. The content included KYC documents (ID cards/passports), account passwords, email addresses, phone numbers, transaction records, hot wallet assets, and wallet private keys, and it demanded US$900,000 (in Bitcoin or Monero). The cybersecurity monitoring agency ThreatMon reported the list.
Binance customer support accounts responded on X that they were aware of the related claims on hacker forums and X and were actively investigating. Based on the descriptions and samples reviewed, this is more likely to be a scam rather than evidence that Binance systems were compromised. At present, no evidence has been found that Binance systems, customer KYC data, account credentials, wallet private keys, or internal infrastructure information were leaked as a result. Binance pointed out that the related claims do not match how it stores data: it does not store passwords in plain text, does not hold users’ external wallet private keys, and the list involved jurisdictions from which Binance has exited. Similar lists in the past have mostly come from information-stealing malware on users’ devices rather than intrusions into platform systems. Binance reminded users to beware of phishing and not to share passwords, 2FA codes, seed phrases, or private keys.
Original sources:
Title: Binance Customer Support response on alleged ShinyHunters data listing Publisher: Binance Customer Support (@BinanceHelpDesk) Date of publication: 2026-11-08 URL: https://x.com/BinanceHelpDesk/status/2119575532895375748 Nature of source: official company customer support statement Verification status: full text of the original post read for this report, verification date 2026-11-09 Support content: under investigation; based on the sample, more likely a scam; no leak of systems, KYC, credentials, private keys, or infrastructure found; does not store passwords in plain text, does not hold external wallet private keys, involves jurisdictions it has exited; similar data mostly comes from malware on users’ devices
ABAB AI Insight
ShinyHunters is a known threat actor active on underground forums and has previously claimed data-related actions against organizations such as Salesforce. This list was reported by ThreatMon around November 8, claiming 335.9 million rows of data and threatening disclosure if payment was not made. Binance customer support’s public response focused on inconsistencies between the sample review results and its internal storage mechanisms, explicitly characterizing the current assessment as “more likely a scam,” while stating that the investigation is still ongoing.
The three technical points emphasized by Binance — not storing passwords in plain text, not holding external wallet private keys, and the data involving jurisdictions it has exited — directly conflict with the list’s promotional claims. External wallet private keys are not held by exchanges in the first place, and storing passwords in plain text is inconsistent with common modern platform practice. These points make the list’s combination of “hot wallet assets + private keys + full KYC” look more like a stitched-together or outdated dataset rather than a fresh extraction from Binance’s core systems.
Similar claims have not been uncommon in the crypto industry. Information-stealing malware often grabs credentials saved in browsers, wallet files, or screenshots from users’ local devices, then sells them on forums under the label of an “exchange leak.” Binance’s response this time explicitly linked past similar lists to such sources and reminded users to guard against phishing. As of now, no independent third party has publicly verified the authenticity of the samples or confirmed a large-scale system intrusion.
The event is currently at the stage of claims versus the company’s initial denial. The final conclusion will depend on Binance’s follow-up investigation and any possible third-party verification. User-side risk remains concentrated mainly in device-side malware and social engineering, rather than a confirmed platform-level data leak.
ABAB News · Cognitive Law
When underground-forum data sales claims are unverified, their credibility should be judged against the platform’s storage mechanisms and the sample contents.
An exchange’s initial response to claims of user-data leakage usually first rules out talking points that clearly conflict with its own technical architecture.