Binance denies breach after actor using ShinyHunters handle claims data sale

What happened

According to BleepingComputer, a threat actor using the ‘ShinyHunters’ handle on a newly emerged underground cybercrime forum claims to be selling records of 335 million Binance users. BleepingComputer says the actor is believed to be impersonating the ShinyHunters extortion gang. This is a claim by the seller. It has not been confirmed or independently verified.

BleepingComputer reports that the allegedly stolen data includes Know Your Customer (KYC) documents, internal infrastructure information, account passwords, crypto wallet private keys, transaction history, emails and phone numbers. The actor reportedly asked for $900,000 and wrote that Binance has only “two options left: pay or leak.”

A Binance spokesperson told BleepingComputer that the company found no evidence of a breach and that the listing is likely a scam. The spokesperson said: “We have found no evidence that Binance systems, customer KYC data, account credentials, wallet private keys, or internal infrastructure information were compromised in connection with this listing.” The spokesperson added that similar past listings have often involved infostealer malware data collected from users’ own devices, not a breach of Binance systems.

According to BleepingComputer, Binance also pointed to parts of the claim that do not match how it stores data. It says it does not hold private keys for users’ external wallets, does not store passwords in plaintext, and no longer operates in some of the jurisdictions the actor named. BleepingComputer adds that other forum users doubted the data was legitimate.

Not confirmed: whether any real data was taken, where any data came from, the entry point, and the actual volume of records. BleepingComputer has not published a sample or any independent verification of the data.

Am I affected?

Not confirmed. Binance denies a breach, and the sources provide no evidence that user data was exposed. BleepingComputer’s report does not say that any specific user or account is affected.

Binance says similar listings have often relied on infostealer data from users’ own devices. The source does not say whether that applies here.

Separately, BleepingComputer notes that Binance confirmed last week that North Korean hackers compromised its wallet infrastructure after an employee was tricked during a fake job interview. This is a different incident, and the article does not link it to the forum listing.

What to do now

1. Treat the data-sale claim as unverified. Follow Binance’s own communications for any update.
2. Following Binance’s stated advice, never share passwords, 2FA codes, seed phrases or private keys with anyone.
3. Stay wary of phishing messages that mention this listing or a “breach”, as Binance advises caution about phishing attempts.
4. Not confirmed by the sources: any further steps such as password resets. The sources do not recommend them, so none are presented here as sourced advice.

Sources

• BleepingComputer: Binance denies data breach after alleged ShinyHunters claims