Binance said it has found no sign of a breach after a threat actor using the ShinyHunters handle tried to sell what the actor described as records covering 335 million of the exchange's users. The listing appeared on a newly emerged underground cybercrime forum, and the actor asked $900,000 for the material, according to the claims. Binance, the largest crypto exchange, characterized the episode as likely a scam.
The seller said the alleged trove included Know Your Customer documents, internal infrastructure information, account passwords, crypto wallet private keys, transaction history, emails and phone numbers. The actor told the forum that Binance had only two choices: pay or face a leak. A Binance spokesperson said the company uncovered no evidence that its systems, customer KYC data, account credentials, wallet private keys or internal infrastructure information were compromised in connection with the listing.
Binance also pointed to details in the claim that conflict with how it handles user data. The exchange said it does not hold private keys for users' external wallets, does not store passwords in plaintext, and no longer operates in some of the jurisdictions the actor cited in the forum post. The spokesperson said similar listings in the past have often involved infostealer malware data gathered from users' own devices rather than a breach of Binance systems.
Other users on the forum voiced doubts about the seller's claims, questioning whether the data was genuine and asking why anyone holding private keys to all the wallets would need to sell them. Binance advised customers not to share passwords, two-factor authentication codes, seed phrases or private keys, and to watch for phishing attempts.
The denial comes after Binance confirmed last week that North Korean hackers tricked an employee into installing malware during a fake job interview, an intrusion that allowed them to steal about $6.34 billion in cryptocurrency after compromising the company's wallet infrastructure. The FBI attributed that breach to the TraderTraitor group, a North Korean state-backed operation also tracked as Lazarus Group, Jade Sleet and APT38.
TraderTraitor has been linked to other major crypto thefts, including the $1.5 billion Bybit hack in February 2025. The two episodes put fresh attention on how attackers target crypto exchanges and their employees, and on the steep financial exposure that follows when wallet infrastructure is compromised.
More cybersecurity news from TechManNews.
