TL;DR:
Categorical rejection: Binance founder Changpeng Zhao (CZ) and platform representatives dismissed an announcement in underground forums offering 335.9 million user records for $900,000.
Absence of evidence: The preliminary review conducted by the company found no technical indications or proof of vulnerabilities in its internal systems, KYC databases, or private keys.
Malware-associated origin: According to the institutional perspective shared regarding the event, lists of this nature are typically compiled using infostealer software directly from users’ personal devices.
This Monday, November 9, Binance stepped up to address claims of an alleged massive leak affecting over 335 million users. The exchange categorically denied these claims. The rumor spread from a post on underground forums, attributed to ShinyHunters, which offered a massive set of information in exchange for $900,000.
This is obviously fake/scam. Anyone who has private keys won’t “sell the data”, they will move the funds. Saw it yesterday, thought it was obvious, but still many media went with it for the headlines. pic.twitter.com/injBH7pXoG
— CZ BNB (@cz_binance) November 9, 2026
Following the spread of rumors across various digital platforms, the company’s founder, Changpeng Zhao (CZ) , labeled the offer an obvious scam. Meanwhile, Binance issued clarifying statements emphasizing that its preliminary investigation has detected no vulnerabilities in corporate infrastructure or identity management systems.
The announced leak claimed to contain 335,900,000 lines of data corresponding to customer records across more than 170 jurisdictions . However, initial technical analyses and cybersecurity firm reports highlighted that the volume of listed lines does not directly equate to an identical number of affected individuals, maintaining the status of an unverified rumor.
Technical evaluation and institutional stance on the notice
The company argued that the announcement lacks legitimate documentary support. According to assessments shared by the organization, similar previous incidents have been linked to the fragmented collection of credentials via infostealer malware installed locally on users’ personal devices, rather than breaches in the central servers of exchanges .
Additionally, platform management recalled that internal security protocols prevent storing passwords in plain text and rule out direct possession of private keys corresponding to clients’ external wallets. Firm authorities reiterated that any attempt to commercialize alleged corporate databases in underground markets pursues fraudulent purposes aimed at extortion and deceiving the digital community.
The company’s security directorate urged users to step up usual precautionary measures, such as using two-factor authentication (2FA) and active vigilance against phishing campaigns that typically exploit the uncertainty generated by these types of announcements on social media. Internal investigations continue as new threat intelligence reports in the digital ecosystem are evaluated.
