"We have found no evidence that Binance systems, customer KYC data, account credentials, wallet private keys, or internal infrastructure information were compromised in connection with this listing," a Binance spokesperson told BleepingComputer.
ShinyHunters-styled listing: 335 million records and a $900,000 demand
A newly emerged underground cybercrime forum post claimed to offer records for 335 million Binance users, asserting the data set included Know Your Customer (KYC) documents, internal infrastructure information, account passwords, cryptocurrency wallet private keys, transaction history, emails, and phone numbers. The person behind the post — described in BleepingComputer's reporting as a threat actor believed to be impersonating the ShinyHunters extortion gang — asked for $900,000 and warned Binance that it had only "two options left: pay or leak."
Binance response: denial and an alternative explanation
Binance categorically denied the forum listing's claims, telling BleepingComputer it had found no evidence of any compromise to Binance systems or to customer KYC data, account credentials, wallet private keys, or internal infrastructure. The exchange said the posting is "likely a scam" and noted similarities to prior listings linked to infostealer malware — data harvested from individual users' devices rather than taken from company systems.
Binance also reiterated customer safety advice: never share passwords, two-factor authentication codes, seed phrases, or private keys, and remain vigilant for phishing attempts.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadTechnical inconsistencies called out by Binance and forum users
Binance pointed to several specific inconsistencies between the listing and how the exchange stores user information. According to the company, it does not hold private keys for users' external wallets and it does not store user passwords in plaintext. The company also said it no longer operates in some of the jurisdictions referenced by the threat actor's post, a mismatch that undercuts parts of the listing.
Forum members who viewed the listing expressed their own skepticism, questioning the listing's logic and veracity; one commenter asked, "If you hold the private keys to all the wallets, what would be the justification for selling this?"
Recent, separate compromise: TraderTraitor and a $6.34 billion theft
The Binance denial arrives against the backdrop of a confirmed, prior compromise of the company's wallet infrastructure. BleepingComputer reported that Binance confirmed North Korean hackers tricked an employee into installing malware during a fake job interview, an intrusion that allowed theft of about $6.34 billion in cryptocurrency after the attackers compromised wallet infrastructure.
The FBI has attributed that breach to a North Korean state-backed hacking group tracked under several names, including TraderTraitor, Lazarus Group, Jade Sleet, and APT38. BleepingComputer also noted previous links between the TraderTraitor cluster and other large crypto thefts, such as the February 2025 Bybit incident referenced in the reporting.
What this means for customers, security teams, and threat actors
- Customers: The immediate practical action is continuity of caution — heed Binance's explicit advice not to disclose passwords, 2FA codes, seed phrases, or private keys, and be alert for phishing that could harvest credentials from personal devices.
- Security teams and incident responders: The episode underscores a dual reality documented in the filing — claims of mass corporate breaches can be either real compromises or opportunistic resales of infostealer data. Teams should therefore validate any reported data set against internal logs and storage practices (for example, whether private keys or plaintext passwords could plausibly be present).
- Threat actors and underground forum participants: The mix of outright denials, forum skepticism, and the earlier TraderTraitor compromise is likely to shape both the credibility assigned to future listings and the market dynamics for stolen data; actors impersonating established gangs may use large, sensational claims to probe buyer interest even when the technical details do not align.
Binance's denial and the forum listing together illustrate the friction between sensational claims on criminal marketplaces and the technical realities of how major exchanges store credentials and keys. The contrasting episodes — an alleged mass data sale and an independently confirmed wallet compromise attributed to a state-backed group — leave a clear question: which disclosures represent opportunistic fraud, and which require immediate forensic action? For now, Binance says this latest listing is not one of the latter.
