Breaches

Binance disputes ShinyHunters claim of 335m stolen user records

Unverified ShinyHunters listing claims 335.9m Binance records. Binance calls it a likely scam, but UK users should brace for phishing.

Warning symbol over a cryptocurrency exchange graphic with the headline Binance disputes 335m record breach claim

A seller using the ShinyHunters name says it holds 335.9 million Binance user records and wants $900,000 to keep quiet. Binance says it has found no sign of a breach and thinks the listing is probably a scam, but UK users should still expect a wave of convincing phishing.

What happened

On 4 November 2026 an advert appeared on PwsForums, an underground cyber crime forum, from an actor posting as ShinyHunters. It offered what it described as 335.9 million lines of Binance customer data from roughly 170 countries. The seller listed email addresses, phone numbers, account passwords, transaction histories, identity documents gathered for know your customer (KYC) checks, including passports and ID cards, private wallet keys, internal infrastructure details and even assets held in Binance’s hot wallets.

The asking price was $900,000, payable in Bitcoin or Monero, along with the usual ultimatum to the exchange: “pay or leak”. A sample was reportedly placed behind a paywall on the forum. The threat monitoring account ThreatMon, which drew wider attention to the post, stressed that nothing had been independently verified, particularly the wallet and private key claims.

Binance responded publicly between 9 and 10 November. A spokesperson told crypto.news that the company was aware of the claims and investigating, but that the description and sample reviewed so far suggested this “appears likely to be a scam rather than evidence of a Binance systems breach”. In statements reported by BleepingComputer and Infosecurity Magazine, the exchange said it had seen no evidence that its systems, KYC data, credentials, wallet keys or internal infrastructure had been compromised in connection with the listing.

For now, then, this is an unverified claim that the alleged victim disputes. It also follows Binance’s separate, confirmed hot wallet theft in late October, which guarantees attention.

The detail

Binance’s rebuttal rests on three specific points. First, it says it does not keep user passwords in plaintext, so a dump presented as containing readable passwords does not match how its platform works. Second, it says it has never held the private keys for wallets that users control themselves outside the exchange. Third, the listing apparently includes countries where Binance no longer operates.

The exchange’s own explanation is that similar listings in the past have usually been assembled from infostealer logs. These are credentials, cookies and saved form data scraped from individual users’ infected computers and phones, then combined and resold. A dataset built that way can look alarming because it contains real email addresses and real passwords, yet none of it comes from the company named in the advert.

The name on the post should be treated with caution too. ShinyHunters is a well known brand in data extortion, and its reputation is exactly why sellers borrow it. According to ThreatMon, the ShinyHunters name has previously been attached to supposed hauls from Salesforce Data.com, the Indian retailer Vijay Sales and Kuwaiti state bodies.

None of this proves the data is worthless. If even part of the dataset is real infostealer output tied to Binance accounts, it gives criminals working credentials and personal details for targeted fraud, whether or not Binance’s own servers were ever touched.

Flow diagram showing the 4 November ShinyHunters listing, the $900,000 demand, Binance's denial, the infostealer explanation and the resulting phishing risk for UK users

Why it matters for UK organisations

Binance has had a substantial number of UK customers. In June 2026 nearly 1,700 UK investors filed a group claim in the High Court alleging the exchange unlawfully sold derivatives products to UK consumers, a reminder that the platform has a real footprint here. Anyone who has used it can expect to receive messages that exploit this story, whether or not their details are in the alleged dump.

The NCSC makes exactly this point in its data breach guidance: criminals use high profile breaches while they are still in the news, sending messages that pretend to come from the affected organisation and ask people to log in, verify their account or claim compensation. Those messages work regardless of whether the breach turns out to be real.

The money at stake is also less protected than many people assume. The FCA’s consumer guidance stresses that most crypto activity sits outside UK regulation, so the Financial Services Compensation Scheme is very unlikely to pay out. A UK victim tricked into handing over a seed phrase or approving a withdrawal has few routes to recovery.

For employers the risk is less direct but real. Staff who trade crypto on work or BYOD devices are prime infostealer targets, and the same malware that harvests an exchange login will also harvest corporate single sign-on cookies and VPN credentials. If this listing does turn out to be stitched together from infostealer logs, those logs almost certainly contain more than crypto accounts.

Expert view

In my experience, the most useful question with a claim like this is not “was Binance breached?” but “where did this data actually come from?” Exchanges are attractive to extortion crews because the headline alone moves markets and generates panic. A seller does not need a real breach to profit, only buyers who believe in one.

Binance’s technical objections are credible, particularly the point about plaintext passwords. When we test platforms of this size, password storage is one of the first things examined, and a mature exchange storing readable passwords would be an extraordinary failure. The stronger risk, as I see it, is the infostealer explanation itself. That shifts the problem from one company’s servers to millions of personal devices, and it is much harder to fix.

Even so, preliminary findings change. The sensible position is to assume the data may be partly genuine and act on the phishing risk now.

What to do now

  1. Warn staff and customers about Binance-themed phishing. Expect emails, texts and calls about “account verification”, “breach compensation” or “security checks”. No genuine service will ask for a password, seed phrase, private key or 2FA code, and Binance has repeated that warning.
  2. Use official channels only. Anyone concerned should check their account by typing the exchange’s address directly or using the official app, never through a link in a message.
  3. Report what arrives. Forward suspicious emails to report@phishing.gov.uk, the NCSC’s reporting service, and suspicious texts to 7726. Losses should be reported to the bank and to Report Fraud.
  4. Change reused passwords and strengthen MFA. Anyone who used their exchange password elsewhere should change it everywhere. Prefer app-based or hardware key authentication over SMS. This maps directly to the Cyber Essentials user access control requirement.
  5. Treat infostealers as a corporate risk. Make sure malware protection is active and current on every device that touches company systems, including BYOD, in line with the Cyber Essentials malware protection control. Restrict access from unmanaged devices where you can.
  6. Watch for leaked credentials. Check corporate domains against breach notification services such as Have I Been Pwned and invalidate sessions for any accounts that appear.

Bottom line

As things stand, this is a large, noisy and unverified claim, and Binance’s reasons for doubting it are technically sound. That does not make it harmless. Whether the 335.9 million records are real, recycled or invented, the publicity hands fraudsters a ready-made story for UK crypto users. Assume the phishing is coming and take infostealers seriously now.

Sources

Related Posts