\n
![](\"https:\/\/media.crypto.news\/2025\/11\/crypto-news-Fragmented-liquidity-hack-crime-option01.webp\")
<\/p>\n
\n<\/p>\n
Binance has disputed claims that hackers stole 335 million user records from the cryptocurrency exchange, saying its preliminary investigation suggests the data listing is likely a scam.<\/p>\n
\n Summary<\/span>\n <\/p>\n <\/p>\n A Binance spokesperson told crypto.news that the exchange was investigating allegations circulated on a hacking forum and X, but an initial review of the advertised information had not identified evidence of a new compromise involving its systems or customer data.<\/p>\n \u201cWe are aware of the claims made on a hacking forum and on X regarding an alleged Binance user data set, and we are actively investigating them,\u201d the spokesperson said.<\/p>\n<\/blockquote>\n \u201cBased on the description provided and the sample information reviewed so far, this appears likely to be a scam rather than evidence of a Binance systems breach.\u201d<\/p>\n<\/blockquote>\n The exchange said its review had found no indication that customer identity documents, account credentials, wallet private keys or internal infrastructure information had been exposed through the advertised dataset.<\/p>\n According to the spokesperson, several details in the listing do not match how Binance manages customer information or operates its cryptocurrency services.<\/p>\n One concern involves the claim that the stolen records contain account passwords. Binance said it does not store user passwords in plaintext, which contradicts the way the alleged information was described.<\/p>\n The listing further claims to contain private keys belonging to cryptocurrency wallets. Binance explained that it does not hold private keys for users\u2019 external wallets, making that part of the allegation questionable.<\/p>\n Another discrepancy concerns the geographical coverage of the supposed breach. The exchange said the listing includes jurisdictions where Binance no longer operates.<\/p>\n The spokesperson suggested that the advertised records could resemble information collected through infostealer malware, which targets individual devices and can capture credentials or other sensitive information.<\/p>\n \u201cSimilar past listings have often involved infostealer malware data collected from users\u2019 own devices rather than a breach of Binance systems,\u201d the spokesperson said.<\/p>\n<\/blockquote>\n The allegations surfaced after cybersecurity monitoring account ThreatMon<\/a> shared details of an underground forum listing attributed to the threat actor ShinyHunters.<\/p>\n \nhttps:\/\/x.com\/MonThreat\/status\/2119359317534986454\n<\/p>\n<\/figure>\n According to ThreatMon, the group claimed to possess 335,900,000 lines of information associated with Binance users across approximately 170 countries.<\/p>\n The advertised dataset allegedly contains email addresses, telephone numbers, passwords, identification documents, transaction histories and other personal details.<\/p>\n ShinyHunters further claimed that the information included internal infrastructure records, private wallet keys and details concerning cryptocurrency assets held in Binance\u2019s hot wallets.<\/p>\n <\/p>\n The group demanded $900,000 in Bitcoin or Monero in exchange for the information and threatened to release the dataset if its demands were not met.<\/p>\n In the forum advertisement, the actor reportedly warned Binance that it had \u201ctwo options left: pay or leak.\u201d<\/p>\n ThreatMon said the seller had placed a sample of the purported records behind a paywall on the forum, but cautioned that the alleged breach had not been independently verified, particularly the claims concerning Binance\u2019s hot wallets and private keys.<\/p>\n The cybersecurity account identified ShinyHunters as a group that had previously advertised alleged breaches involving Salesforce Data.com, Indian electronics retailer Vijay Sales and Kuwaiti government entities.<\/p>\n The allegations have surfaced shortly after Binance suffered a separate, confirmed security breach on October 29, when attackers stole approximately $6.34 billion in cryptocurrency from its hot wallets.<\/p>\n In its November 3 incide<\/a>n<\/a>t report<\/a>, Binance traced the attack to compromised employee devices, malicious software and stolen credentials that eventually allowed unauthorized access to wallet signing infrastructure.<\/p>\n The exchange subsequently reported that approximately $2.85 billion had been frozen or intercepted, while it used company resources to replace affected customer assets.<\/p>\n On November 5, Binance requested the return<\/a> of 8,425.997 ETH and approximately 74.56 million ARB that had been frozen following the attack.<\/p>\n The earlier incident involved unauthorized cryptocurrency transfers, while the latest ShinyHunters listing alleges the theft of customer records and credentials.<\/p>\n Binance has separately warned customers about phishing messages<\/a> that impersonate exchange security alerts and direct recipients to fraudulent websites designed to collect login information.<\/p>\n In its latest response, the spokesperson urged users to remain cautious of suspicious communications and avoid disclosing passwords, two-factor authentication codes, wallet seed phrases or private keys.<\/p>\n <\/p><\/div>\n\n\n
\n
\n
Binance questions credibility of alleged stolen data<\/strong><\/h2>\n
\n
ShinyHunters demanded $900,000 for Binance records<\/strong>?<\/h2>\n
Binance\u2019s response follows October hot wallet attack<\/strong><\/h2>\n