Binance says ShinyHunters’ alleged 335 million-record leak may be a scam

The claims circulated on a hacking forum and X. A Binance spokesperson told crypto.news the company was investigating and said the sample information reviewed so far appeared more consistent with a scam than a breach. The exchange said it had found no indication that identity documents, account credentials, wallet private keys or internal infrastructure details had been exposed through the advertised dataset.

The spokesperson cited several discrepancies. Binance said it does not store passwords in plaintext and does not hold private keys for users’ external wallets. The listing also reportedly covers jurisdictions where Binance no longer operates. The spokesperson suggested the data could instead resemble information gathered by infostealer malware from individual devices. Such malware can capture credentials and other sensitive details, the spokesperson said, adding that similar past listings often involved device-level infections rather than a breach of Binance systems.

Cybersecurity monitoring account ThreatMon reported the forum listing and said the seller had put a sample behind a paywall. ThreatMon cautioned that the claims had not been independently verified, particularly allegations involving Binance hot wallets and private keys. The seller reportedly threatened to release the records unless paid, saying Binance had “two options left: pay or leak.”

The listing follows a separate, confirmed security incident on October 29. Binance said attackers stole approximately $6.34 billion in cryptocurrency from hot wallets after compromising employee devices and credentials, and accessing wallet-signing infrastructure. The exchange later reported that approximately $2.85 billion had been frozen or intercepted and said it used company resources to replace affected customer assets. Binance has also urged users to avoid sharing passwords, two-factor authentication codes, seed phrases or private keys in response to phishing attempts.