\n
![](\"https:\/\/media.crypto.news\/2024\/12\/crypto-news-Changpeng-CZ-Zhao-option08.webp\")
<\/p>\n
\n<\/p>\n
Binance founder Changpeng Zhao has dismissed a claim that 335 million user records were stolen as \u201cobviously fake\/scam,\u201d challenging the alleged seller\u2019s decision to offer private keys for $900,000 instead of using them to take funds.<\/p>\n
\n Summary<\/span>\n <\/p>\n <\/p>\n CZ, responding<\/a> on X on Nov. 9, argued that anyone possessing usable private keys would move the cryptocurrency instead of trying to sell the information. He said he had seen the claim the previous day and considered its problems obvious.<\/p>\n \u201cSaw it yesterday, thought it was obvious, but still many media went with it for the headlines,\u201d he wrote.<\/p>\n His response quoted ThreatMon\u2019s post describing an underground forum advertisement attributed to ShinyHunters. The monitoring account\u2019s own account of the listing said the alleged breach had not been independently verified.<\/p>\n Binance had already challenged the advertisement before its founder\u2019s intervention. As previously reported by crypto.news, the exchange\u2019s preliminary review characterized<\/a> the listing as a likely scam and found no indication that the advertised information demonstrated a breach of its systems.<\/p>\n A spokesperson said the company was actively investigating the claims and had reviewed the description and sample information available at that stage.<\/p>\n <\/p>\n The exchange identified several inconsistencies. It said it does not store account passwords in plaintext or hold private keys for customers\u2019 external wallets. The listing referred to jurisdictions where Binance no longer operates, according to the spokesperson.<\/p>\n Binance suggested that similar past advertisements had involved information collected by infostealer malware from individual users\u2019 devices. Its statement did not establish that this particular dataset came from such malware.<\/p>\n ThreatMon\u2019s post<\/a> described a dataset containing 335,900,000 lines associated with users in approximately 170 countries. The advertised contents included identity cards and passports, email addresses, phone numbers, account passwords, transaction histories, and internal infrastructure details.<\/p>\n The seller purported to hold private wallet keys and information concerning assets in Binance\u2019s hot wallets. According to the monitoring account, the asking price was $900,000 in Bitcoin or Monero, accompanied by a threat to publish the material unless Binance paid.<\/p>\n A sample was reportedly placed behind a forum paywall. ThreatMon specifically described the hot-wallet and private-key allegations as unverified.<\/p>\n CZ\u2019s criticism focused on how outlets handled the claim, but his post did not name individual publications or identify particular headlines. He offered an argument against the seller\u2019s private-key claim, without publishing a technical examination of the advertised records.<\/p>\n Security firm Brandefense documented<\/a> four versions of a similar advertisement dated Oct. 30 through Nov. 2. Its research described near-identical wording appearing under three Telegram account names, leaving it unable to determine whether one seller or several reposters were involved.<\/p>\n The advertised price varied. A Nov. 1 version sought a negotiable $500,000, while two Nov. 2 versions mentioned $900,000, with one suggesting the price might fall to $500,000.<\/p>\n Brandefense considered the mixed contents and private-key offer more consistent with recycled information or a scam. The firm said it had not opened or tested a sample as of Nov. 3.<\/p>\n Its analysis distinguished the advertised line count from a count of affected people: 335.9 million lines do not establish that 335.9 million individual customers had information stolen.<\/p>\n In its Nov. 3 incident report<\/a>, Binance described a separate $6.34 billion theft on Oct. 29 involving unauthorized access to its wallet signing service.<\/p>\n The exchange\u2019s account of the attack<\/a> traced the intrusion through compromised employee devices and stolen deployment credentials. Its report said attackers used Ethereum permissions to keep moving assets after normal withdrawals were suspended.<\/p>\n Binance reported that the final unauthorized transfer of 2,961.9 ETH settled at 23:56 UTC on Oct. 29. Its report cited the FBI\u2019s attribution of that attack to North Korea.<\/p>\n Separately, Binance\u2019s September warning about phishing texts<\/a> described messages alleging suspicious logins or account changes and directing recipients through shortened links. The exchange said it never asks customers to verify or secure their accounts through text-message links.<\/p>\n <\/p><\/div>\n\n\n
Binance disputes the alleged 335 million-record breach<\/h2>\n
The seller claimed 335.9 million lines across 170 countries<\/h2>\n
Earlier advertisements carried different asking prices<\/h2>\n
October\u2019s wallet attack had a documented transaction trail<\/h2>\n