Cryptocurrency exchange Binance has rejected allegations that hackers obtained sensitive information belonging to 335 million users. The claims appeared on a newly established cybercrime forum, where an individual using the ShinyHunters name advertised a large collection of supposedly stolen customer and internal company data.
The seller demanded $900,000 for the information and threatened to publish it unless Binance paid. However, the authenticity of the advertised records remains unverified, and there is no confirmed connection between the individual behind the listing and the established ShinyHunters extortion group.
According to the forum advertisement, the alleged database contains identity verification documents, email addresses, telephone numbers, account passwords, cryptocurrency transaction histories, wallet private keys, and details about Binance’s internal infrastructure.
Binance has found no evidence supporting the claimed intrusion. The exchange suggested that the advertisement was likely fraudulent rather than evidence of another compromise of its systems.
Several inconsistencies raised doubts about the listing. Binance explained that it does not possess private keys belonging to customers’ external cryptocurrency wallets and does not store user passwords in plaintext. The advertisement also referenced jurisdictions where the exchange no longer operates.
Other participants on the cybercrime forum questioned the seller’s credibility. One particularly notable inconsistency involved the alleged possession of cryptocurrency wallet private keys. Such access could potentially allow an attacker to transfer assets directly, raising questions about why the seller would instead advertise the information for a fixed payment.
Binance also noted that previous advertisements claiming to contain information stolen from cryptocurrency exchanges have sometimes involved credentials collected by infostealer malware. These malicious programs can extract passwords and other information from infected personal devices without compromising the exchange’s own infrastructure.
Nevertheless, the company has not established where the advertised information originated or whether any genuine customer records are included. The existence of a forum listing alone does not demonstrate that Binance suffered a new data breach.
The allegations surfaced shortly after a separate, confirmed cyberattack against Binance in late October 2026. In that incident, attackers compromised employees’ computers through malicious software and social engineering, eventually gaining unauthorized access to cryptocurrency wallet infrastructure.
Binance reported approximately $6.34 billion in affected digital assets and said it had frozen or intercepted around $2.85 billion. US authorities attributed the attack to North Korea’s TraderTraitor hacking group.