Binance denies alleged data breach involving 335 million user records
TL;DR
Binance has denied claims of a massive data breach after a threat actor using the 'ShinyHunters' handle offered to sell records of 335 million users. The attacker demanded $900,000 to prevent a leak of KYC documents, passwords, and private keys. Users should monitor their accounts for unauthorized activity and remain alert for phishing.
What happened
A threat actor on an underground cybercrime forum claimed to have stolen records belonging to 335 million Binance users. The alleged data includes Know Your Customer (KYC) documents, internal infrastructure details, account passwords, crypto wallet private keys, transaction histories, emails, and phone numbers. The attacker demanded $900,000, stating Binance had only two options: pay or leak.
Binance spokespeople stated they found no evidence that any systems, customer KYC data, account credentials, wallet private keys, or internal infrastructure were compromised. The company noted several inconsistencies in the claim, stating they do not store user passwords in plaintext and do not hold private keys for users' external wallets. Binance suggested the data might actually be logs collected from users' own devices via infostealer malware rather than a central breach of their systems.
Why it matters
Even if this specific claim is a scam or a result of infostealer malware, it underscores the persistent risk to individual users. While the central exchange may be secure, the theft of credentials from end-user devices remains a massive threat in the crypto industry. This incident follows a confirmed breach where North Korean hackers, tracked as TraderTraitor or Lazarus Group, compromised Binance wallet infrastructure to steal approximately $6.34 billion.
Who is affected
- Binance users
What to do now
- Never share passwords, 2FA codes, seed phrases, or private keys with anyone.
- Monitor all accounts for unauthorized activity or suspicious transactions.
- Watch for phishing attempts targeting your account credentials or personal information.
What we don't know yet
- Whether the threat actor actually possesses any legitimate Binance data.
- The true identity and origin of the actor using the 'ShinyHunters' handle.
- Whether the data consists of stolen Binance system records or infostealer logs from individual end-user devices.
Sources
