335.9 million lines of records — that is the quantity an extortion group named ShinyHunters claimed on November 4 to be offering for sale on PwsForums, and the size of the headline at the centre of Binance’s latest security scrutiny.
ShinyHunters' PwsForums claim: what was advertised
In its November 4 posting, ShinyHunters said it was selling “335.9 million” lines of records including private key wallets, user account passwords, transaction histories, email addresses and phone numbers, internal infrastructure information, KYC data including ID cards and passports, and “crypto assets in Binance’s hot wallet.” The group attached a $900,000 demand and framed the options as stark: “pay or leak.”
Binance response: investigation and public statements
Binance said it is actively investigating the claim. In a direct message sent via the firm’s customer support account on X, Binance assessed that, “based on the sample information and the description of the data ‘this appears likely to be a scam rather than evidence of a Binance systems breach.’” The company added, “We have found no evidence that Binance systems, customer KYC data, account credentials, wallet private keys, or internal infrastructure information were compromised in connection with this listing.”
Binance also identified several asserted inconsistencies between the listing and the company’s data practices: “Several aspects of this claim are inconsistent with how Binance stores and protects user data: Binance does not store user passwords in plaintext; Binance does not hold private keys for users’ external wallets; and the listing references jurisdictions where Binance no longer operates.”
At the same time, Binance warned that listings like this have in the past been driven by infostealer malware on victims’ devices rather than an intrusion into the company’s systems, and it urged users to remain watchful for follow-on phishing attempts seeking passwords, 2FA codes, seed phrases and private keys.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleTraderTraitor theft, laundering activity, and meme coins
Binance is handling these claims while also managing the fall‑out from a separate, large theft at the end of October. According to the reporting, a group called TraderTraitor stole around $6.3bn in virtual currency from Binance after a months-long, multi-stage attack that involved fake job interviews and zero-day malware.
Blockchain investigators say the group is now attempting to launder the stolen funds by creating meme coins to disguise money flows. As Elliptic chief scientist and co‑founder Tom Robinson explained: “Anyone can create a new crypto token, and thousands of new tokens appear every day. Most are meme coins: tokens built around a joke, an animal or a celebrity, and traded on hype rather than any underlying use.” He went on to describe the laundering logic: “The launderers' tokens are made to be used once and thrown away. Nobody outside the laundering operation buys them, and their price is whatever the launderers choose to set. That makes them useful as a container, allowing stolen funds to go in on one side of a liquidity pool and come out on the other.”
What this means for technologists, end users, and policymakers
- Technologists and security teams: Expect scrutiny on endpoint compromise and infostealer malware as a likely vector for data harvested from users; the Binance message points to device‑level infection rather than a single platform back‑end breach.
- End users and account holders: Binance explicitly warned users to be on the lookout for phishing that requests passwords, 2FA codes, seed phrases and private keys — specific items cited in the advisory linked to the ShinyHunters listing.
- Policymakers and regulators: The simultaneous presence of an extortion claim and a large crypto theft with active laundering strategies underscores cross‑cutting challenges: assessing evidence of platform compromise, tracking novel token‑based laundering, and clarifying jurisdictional exposure where platforms no longer operate.
The record presented to date is twofold: a high‑volume extortion claim on a public forum and an apparently unrelated, confirmed theft that continues to move through the crypto ecosystem via newly issued tokens. Binance says it has found no evidence tying the forum listing to an internal systems compromise, but it has also signalled the concrete risks that follow from device‑level malware and post‑theft laundering methods. The next visible markers will be whether ShinyHunters produces credible samples that withstand forensic review, whether Binance’s investigation identifies a compromise path, and how rapidly blockchain investigators can map and choke off the meme‑coin channels used to wash the $6.3bn reported stolen.
https://www.infosecurity-magazine.com/news/binance-investigates-shinyhunters/
