Binance denied a data breach on Monday, November 9, after a forum actor using the ShinyHunters name claimed to hold data on 335 million users and demanded $900,000 to prevent a leak. The exchange said it found no evidence of a compromise.
Forum Actor Claims KYC Documents, Passwords and Wallet Keys
The actor claims the stolen data includes KYC documents, passwords, wallet private keys, transaction histories, contact information and infrastructure details. The listing sets a $900,000 price, with the data to be leaked if the demand goes unpaid.
The claim uses the ShinyHunters name, but it comes from a forum account, and the reporting does not confirm that the established group is behind it. Forum users who examined the claim doubted its authenticity.
Binance Cites No Plaintext Passwords or External Wallet Keys
Binance said it found no evidence of a compromise. It added that it does not store plaintext passwords or private keys for external wallets, which would make parts of the claimed dataset impossible to obtain from its systems as described.
The company suggested the data may have originated from infostealer malware. Infostealers harvest credentials and other information from infected user devices, so material collected that way can resemble a platform breach without any intrusion into the platform.
Infostealer Logs as a Likely Source of Claimed Data
If the data came from infostealer logs, it would consist of credentials and details gathered from individual users’ machines and compiled into a larger set. Binance’s statement points in this direction but does not prove it, and the company said it is investigating the claim.
A Separate Matter From the $6.3 Billion Binance Theft
The claim is distinct from the earlier $6.3 billion Binance theft that has already been reported. The two incidents are unrelated according to the available reporting, and the new claim concerns user data rather than stolen funds.
What Is at Stake if the 335 Million Figure Were Real
The scale of the claim is large. KYC documents link identities to financial accounts, so exposure of that material would carry risks well beyond a password reset, including identity fraud. Transaction histories and wallet-related data would add further sensitivity. None of this has been verified.
Verification Gap Leaves the Claim Unproven
At this point the claim rests on an anonymous forum post and a company denial. No sample data has been confirmed as genuine, and the reporting identifies no independent analysis of the dataset. Binance’s investigation of the claim is ongoing, and the company has not announced findings.
Extortion posts that attach a well-known group name to a dataset can draw attention whether or not the data is authentic. The $900,000 price is small relative to the size of the user base claimed, a detail that the forum users who doubted the post may also have weighed, though the reporting does not say what they cited.
The status will stay unresolved until the actor publishes proof that holds up, the data leaks, or Binance finishes its review and says what it found.
Disputed Claim Compared With What Binance Said
The two sides disagree on both facts and sourcing. The forum actor lists KYC documents, passwords, wallet private keys, transaction histories, contact information and infrastructure details. Binance replied that it does not store plaintext passwords or external wallet private keys, which directly contradicts two items on the actor’s list. The company also pointed to infostealers as a possible source of any real data. The actor’s demand is $900,000 against a claimed 335 million users, and forum users who doubted the post did so before any sample was verified.
