CZ rejects claim that 335 million Binance records were stolen

Writing on X on Nov. 9, Zhao said he had seen the claim the previous day and criticized media outlets for covering it “for the headlines.” His post quoted ThreatMon, whose account described an underground forum advertisement attributed to ShinyHunters. ThreatMon said the listing itself had not been independently verified.

The advertisement claimed to contain information associated with users in approximately 170 countries, including identity documents, email addresses, phone numbers, passwords, transaction histories and internal infrastructure details. The seller also claimed to have private wallet keys and information about assets in Binance hot wallets, and reportedly demanded $900,000 in Bitcoin or Monero, threatening to publish the material unless Binance paid.

Binance said it was investigating and had found no indication that the advertised information demonstrated a breach of its systems. The exchange said it does not store account passwords in plaintext or hold private keys for customers’ external wallets. It also cited references to jurisdictions where Binance no longer operates. The company suggested similar past advertisements may have used information gathered by infostealer malware from individual devices, but did not say that was the source of this dataset.

Security firm Brandefense documented four similar advertisements dated Oct. 30 to Nov. 2, appearing under three Telegram account names. Prices varied: one Nov. 1 post sought a negotiable $500,000, while two dated Nov. 2 asked for $900,000, with one indicating the price could fall to $500,000. Brandefense said it had not opened or tested a sample as of Nov. 3 and considered the mix of material and private-key offer consistent with recycled information or a scam. It also cautioned that 335.9 million lines do not establish that the same number of individual customers were affected.

The claim is separate from a documented Oct. 29 wallet attack. Binance’s Nov. 3 incident report described a $6.34 billion theft involving unauthorized access to its wallet signing service, tracing it to compromised employee devices and stolen deployment credentials. The report said the final unauthorized transfer, 2,961.9 ETH, settled at 23:56 UTC and cited the FBI’s attribution of the attack to North Korea.