Binance is currently investigating claims made by the threat actor group ShinyHunters, which alleges it has successfully breached the cryptocurrency exchange’s systems. On November 4, 2026, the group posted an advertisement on the PwsForums platform, asserting that it had obtained approximately 335.9 million records. The attackers are demanding a payment of $900,000, threatening to leak the data if their financial demands are not met.
The data allegedly held by the group is extensive, purportedly containing user account passwords, email addresses, phone numbers, transaction histories, and Know Your Customer (KYC) documentation, such as passport and ID card scans. Furthermore, the group claims to possess internal infrastructure information and private keys for Binance hot wallets, which they suggest would allow them to access crypto assets directly.
In response to these claims, Binance has stated that it has found no evidence to support the occurrence of a system-wide breach. The company maintains that its internal infrastructure, customer KYC data, account credentials, and private keys remain secure. Binance officials have characterized the ShinyHunters listing as a likely scam rather than a genuine compromise of their internal databases.
Binance highlighted several technical inconsistencies between the attackers' claims and the company’s actual security architecture. Specifically, the exchange noted that it does not store user passwords in plaintext, nor does it hold private keys for external user wallets. Additionally, the data allegedly offered for sale references geographic jurisdictions where the exchange does not currently operate, casting further doubt on the legitimacy of the stolen material.
The company suggested that the data being circulated by the attackers may have been harvested from individual users via infostealer malware rather than through a centralized breach of Binance systems. Such malware often infects personal devices, scraping credentials and session data directly from the victim's browser or local files. Binance has urged its user base to remain vigilant against potential follow-on phishing campaigns that might attempt to solicit passwords, two-factor authentication codes, or seed phrases.
This incident follows a separate, confirmed security event involving the exchange that occurred in late October. In that instance, North Korean actors associated with the TraderTraitor group successfully executed a multi-stage attack involving fraudulent job interviews and zero-day malware, resulting in the theft of approximately $6.3 billion in virtual currency.
Blockchain investigators are currently tracking the movement of those stolen funds. Reports indicate that the perpetrators are attempting to launder the assets by cycling them through various meme coins. By creating these tokens, the attackers can create artificial liquidity pools, allowing them to move stolen funds through a series of transactions designed to disguise the origin of the capital.
While the investigation into the ShinyHunters claim remains active, Binance continues to emphasize that there is no indication of a breach of its own internal systems. The exchange maintains that the current situation is distinct from the October theft and advises users to prioritize account security measures, such as enabling robust multi-factor authentication, to protect against potential phishing attempts stemming from the alleged data leak.
