Binance is disputing a Binance data breach claim advertising 335.9 million lines of user information, saying its initial review points to a likely scam rather than a compromise of its systems. The exchange’s customer-support account published that assessment on November 8, 2026, while Binance continues investigating the allegations.
Key takeaways
ThreatMon identified a listing attributed to ShinyHunters seeking $900,000.
Binance says the advertised information conflicts with its security practices.
A separate October 29 wallet attack affected approximately $6.34 billion in digital assets.
Binance challenges the data breach claim
Binance says its review found no evidence that the advertised dataset reflected a compromise of its systems or customer information. Its support account said it found no indication of exposure involving identity-verification records, account credentials, wallet private keys or internal infrastructure information connected to the listing.
Cybersecurity monitoring firm ThreatMon reported that a hacking-forum advertisement attributed to ShinyHunters offered 335,900,000 lines of information purportedly covering Binance users in approximately 170 countries.
That advertised line count is not a confirmed number of affected people . The seller sought $900,000, payable in Bitcoin or Monero, and threatened to publish the information unless Binance paid, ThreatMon reported.
Listing details draw questions over credibility
Binance points to contradictions between the listing’s claims and how it handles user information. The exchange says it neither stores passwords in plaintext nor holds private keys belonging to users’ external wallets.
According to the advertisement’s claims, the leaked data included email addresses, phone numbers, passwords, identity cards or passports, transaction histories and various other personal details. The listing also claimed to contain wallet private keys, internal infrastructure details and information about assets held in Binance’s hot wallets.
Binance said the listing names jurisdictions where it no longer operates. Its support account also noted that comparable past advertisements involved information collected through infostealer malware on users’ devices, rather than material taken from Binance infrastructure.
ThreatMon described the allegation as unverified and said the seller had put a sample behind a forum paywall.
Brandefense reached a similarly skeptical assessment. On November 3, 2026, its research team said it had examined four versions of related Telegram advertisements without opening or testing a sample. The researchers judged the combination of identity documents, wallet keys and infrastructure information more consistent with recycled data or a scam than with a single extraction. They could not establish that the advertisements contained genuine Binance data.
October 29 wallet attack was a separate incident
The alleged Binance data breach is distinct from the wallet attack on October 29, 2026. Binance’s November 3 incident report said that attack affected approximately $6.34 billion in digital assets .
Binance said attackers accessed an internal wallet-signing service without authorization and initiated transfers outside its regular withdrawal process. The exchange traced the attack through compromised employee computers and stolen credentials.
Binance urges users to guard authentication details
Binance’s support account urged users to stay alert for phishing attempts . It advised them never to disclose passwords, two-factor authentication codes, seed phrases or private keys.
Article produced with the assistance of artificial intelligence and reviewed by the editorial team.
