Binance is actively looking into allegations from a well-known extortion group claiming it has acquired 335 million customer records, according to a report published by Infosecurity Magazine on November 4. The group, ShinyHunters, posted an advertisement on PwsForums demanding $900,000 from the cryptocurrency exchange and threatening to leak the data if payment wasn't made. However, the company says initial evidence suggests the claim is likely fraudulent rather than proof of an actual breach.
ShinyHunters' listing claimed it was selling 335.9 million lines of records that included private key wallets, user account passwords, transaction histories, email addresses, phone numbers, internal infrastructure details, know-your-customer data such as ID cards and passports, and cryptocurrency assets held in Binance's hot wallet. The extortion message told the exchange it had two options remaining: pay the ransom or face a data leak. The advertisement appeared on PwsForums on November 4, offering the purported dataset for sale to the highest bidder.
A customer support message sent by Binance on X stated that "based on the sample information and the description of the data, this appears likely to be a scam rather than evidence of a Binance systems breach." The company said it found no proof that its systems, customer KYC data, account credentials, wallet private keys, or internal infrastructure information had been compromised in relation to this listing. According to the report, Binance pointed out several inconsistencies with how it actually stores and protects user information: the exchange doesn't store user passwords in plaintext, doesn't hold private keys for users' external wallets, and the listing referenced jurisdictions where Binance no longer conducts business.
The company explained that similar listings appearing in the past often resulted from infostealer malware installed on victims' devices rather than breaches of the firm's own systems. This type of malware captures credentials and personal information directly from infected computers and phones, which criminals then bundle together and falsely present as corporate data breaches. Despite dismissing the current claim, Binance warned users to stay alert for follow-up phishing attempts seeking passwords, two-factor authentication codes, seed phrases, and private keys. Meanwhile, the exchange continues dealing with fallout from a massive October theft by North Korean actors called TraderTraitor, who stole roughly $6.3 billion in virtual currency through a months-long attack involving fake job interviews and zero-day malware. Blockchain investigators report the group is now attempting to launder the stolen funds by creating meme coins to hide money flows—tokens built around jokes, animals, or celebrities that can be used once and discarded, with prices set arbitrarily by the launderers themselves to move stolen assets through liquidity pools.
The extortion attempt highlights how threat actors increasingly use fear tactics and fabricated breach claims to extract payment from major platforms, even when no actual compromise has occurred. For organizations managing sensitive financial data, the challenge isn't just defending against real attacks—it's also managing reputational risk and customer anxiety when fraudulent claims surface publicly.