A hacking group known as ShinyHunters claims to have stolen 335.9 million lines of data linked to Binance users and is demanding $900,000 from the cryptocurrency exchange to prevent the information from being released.
The alleged dataset reportedly contains sensitive customer information, including email addresses, phone numbers, passwords, identity documents and transaction histories. The group also claims to have wallet-related information and details about Binance’s internal infrastructure.
However, the claims remain unverified. Binance says its preliminary investigation suggests the listing is likely a scam rather than evidence of a breach of its systems.
What ShinyHunters claims to have stolen
Cybersecurity monitoring account ThreatMon reported a listing attributed to ShinyHunters that advertises 335.9 million lines of information allegedly linked to Binance users across approximately 170 countries.
The group reportedly wants $900,000 in cryptocurrency, with Bitcoin or Monero named as payment options. It has threatened to release the information if Binance refuses to pay.
The advertised information allegedly includes customers’ contact details, passwords, identity documents and transaction histories. The listing also claims to contain wallet-related information and details about Binance’s internal systems.
But there is an important distinction: 335.9 million lines of data do not necessarily represent 335.9 million individual customers. The dataset could contain duplicate records, outdated information or data collected from unrelated sources.
Neither the authenticity of the dataset nor its alleged source has been independently confirmed.
Binance says the listing is likely a scam
Binance has pushed back against the allegation, saying it is investigating claims circulating on hacking forums and social media.
In its preliminary response, the exchange said it had found no evidence that its systems, customer identity-verification data, account credentials, wallet private keys or internal infrastructure had been compromised in connection with the listing.
Binance also questioned the credibility of the advertised information. The company said it does not store user passwords in plain text and does not hold the private keys for users’ external wallets. It also identified references to jurisdictions where Binance no longer operates as another inconsistency.
The exchange suggested that the information could resemble data collected through infostealer malware, which steals saved passwords and other sensitive information from infected computers and phones.
This does not prove that the listing is fraudulent. However, it highlights why the appearance of Binance-related credentials in a dataset does not automatically mean hackers breached the exchange itself. Binance’s investigation remains ongoing.
Even if the alleged dataset turns out to be fake or recycled from older leaks, claims of a major data breach can create opportunities for scammers.
Hackers and scammers often use breach reports to send fake security alerts, impersonate exchange support teams and direct users to fraudulent websites. These messages may claim that an account has been compromised and pressure the recipient to disclose login details or move funds to a supposedly safe wallet.
If any of the advertised personal information is genuine, it could also make targeted phishing attempts more convincing.
Binance users should avoid sharing passwords, two-factor authentication codes, wallet seed phrases or private keys. They should also use unique passwords, enable strong two-factor authentication, review account activity and avoid clicking links in unsolicited messages about the alleged leak.
The claim follows a separate Binance security incident
The data-extortion allegation emerged shortly after Binance disclosed a separate security incident involving unauthorised cryptocurrency transfers from its hot wallets on October 29.
In an update published on November 3, Binance said approximately $6.34 billion in digital assets had been affected by that incident. The exchange reported that about $2.85 billion had been frozen or intercepted at the time of the update and said it would cover the financial impact of the stolen assets.
Binance attributed the earlier incident to unauthorised access to an internal wallet-signing service. It also said the investigation was continuing and that independent cybersecurity experts would review the incident.
The two cases must be treated separately. The October incident involved unauthorised asset transfers, while the latest listing alleges the theft of customer records and other information. Binance has not confirmed a connection between them.
What happens next?
The key question is whether ShinyHunters can produce verifiable evidence that the advertised information is genuine and was obtained from Binance.
Until independent researchers authenticate the dataset or Binance provides further findings, the alleged theft of 335.9 million user records should not be reported as a confirmed breach.
For now, Binance says it has found no evidence of a systems or customer-data compromise linked to the listing. Its ongoing investigation should help establish whether the claim is credible or an attempt to extort the exchange using questionable data.
Read also: Coinbase receives full US federal approval for trust bank