Binance 335 Million Records Claim: Scam or Real Breach?

A seller on an underground forum is offering what it claims is Binance user data covering 335.9 million records, and asking $900,000 in Bitcoin or Monero for it. Binance says the listing is likely a scam, founder Changpeng Zhao has publicly dismissed the claim, and no independent party has verified that the data is real. The Binance 335 million records claim is the latest twist in the aftermath of the exchange's $6.3 billion wallet hack on 29 October 2026 — but it is a different kind of allegation, and it needs to be judged on its own evidence. This guide explains what the seller claims, what Binance and the security firms actually found, why a big line count does not equal a big victim count, and what Indian users should check right now.

> Educational content only. This is not financial advice. Crypto markets are volatile — never invest money you can't afford to lose. This guide explains a reported claim about a data sale; it does not confirm any breach, predict any price movement, or recommend any coin or platform. For account security issues, use the exchange's official support channels only.

What the Seller Claims

The claim surfaced on 9 November 2026, when threat-monitoring accounts and crypto news outlets reported a listing on a newly emerged underground cybercrime forum. The seller used the name ShinyHunters, a handle associated with a known extortion group, and advertised a dataset of 335,900,000 lines of information said to cover customers in approximately 170 countries. The asking price was $900,000, payable in Bitcoin or Monero — roughly ₹8.5 crore at current exchange rates — and the seller threatened to publish the data if Binance did not pay.

According to the reports, the advertised contents included identity cards and passports, email addresses, phone numbers, account passwords, transaction histories and internal infrastructure details. The listing also purported to hold private wallet keys and information about assets in Binance's hot wallets. That combination — identity documents plus passwords plus private keys — is what made the claim alarming: if true, it would mean the attacker held the keys to users' accounts and their funds, not just a list of names.

There is an important caveat that every report carried. ThreatMon, the threat-monitoring account that documented the listing, said the alleged breach had not been independently verified. The seller put a sample of the data behind a forum paywall, so the public could not inspect it, and the monitoring firms that tracked the listing did not open or test any sample. In other words, the claim exists, but the evidence for it is a seller's advertisement — not a demonstrated leak.

What Binance and CZ Said

Binance pushed back before its founder spoke. Its customer-support account said on 8 November that it had found no evidence that its systems, customer identity-verification data, account credentials, wallet private keys or internal infrastructure had been compromised in connection with the listing. A Binance spokesperson told reporters that the assessment was based on the listing's description and the sample information reviewed so far, and added that the offer "appears likely to be a scam rather than evidence of a Binance systems breach."

On 9 November, founder Changpeng Zhao responded on X, dismissing the claim as "obviously fake/scam". His argument was a practical one: if the seller genuinely held usable private keys, the rational move would be to use them to move cryptocurrency, not to try to sell the information for $900,000. He also criticised media coverage of the claim, arguing that repeating an unverified seller's advertisement as though it were a confirmed breach misleads readers.

Binance added a detail that matters for users. The exchange said parts of the listing are inconsistent with how it stores user data, and noted that similar past listings have often involved infostealer data — information stolen from users' own devices by malware — rather than a breach of the exchange's systems. That distinction is the difference between "the exchange was hacked" and "some users' computers were infected and their saved passwords were harvested". Both are bad, but they require very different responses, and only one of them is the exchange's fault.

What the Security Firms Found

Two security firms added context that helps to judge the claim, and both pointed in the same direction: caution, not confirmation.

Brandefense, a cybersecurity firm, documented four versions of a near-identical advertisement dated 30 October through 2 November, published under three Telegram accounts. The ads predate the public reports of 9 November by about a week, which means the listing was circulating in criminal channels before it became news. Brandefense said it had reviewed the advertisements but had not opened or tested any sample, so it could not confirm whether the data was genuine either.

Brandefense also drew a line that the raw number invites readers to blur. The listing advertised 335.9 million lines of information. A line count is not a count of people. One person's data can appear on many lines — an email address, a phone number, a password, a transaction record — and a dataset can contain duplicates, old records, or records stitched together from earlier, unrelated leaks. So 335.9 million lines does not establish that 335.9 million individual customers were affected, even if the data were real.

BleepingComputer, which reported the claim on 9 November, added another wrinkle: the actor using the ShinyHunters handle is believed to be impersonating the group, although the report cited no specific evidence for that belief. Public reporting has shown that the ShinyHunters name has been widely impersonated, so the handle on a listing is not reliable proof of who is behind it. An impersonator has an obvious motive: a famous group's name makes a listing look more credible, and credibility is what sells stolen data.

None of this proves the data is fake. It proves the data is unverified, and that the people best placed to check — Binance itself, and the firms that tracked the listing — have either found no evidence of a breach or have been unable to confirm anything at all.

Why 335.9 Million Lines Is Not 335.9 Million Victims

The number is the headline, so it deserves a closer look. Binance has about 335 million registered users globally, a figure the exchange itself has cited in its own reporting — and the listing's 335.9 million lines sits suspiciously close to that total. A genuine leak of every single registered user, down to the last account, would be an extraordinary claim. A seller inventing a number, on the other hand, would naturally pick one near the known user count, because it sounds complete and therefore valuable.

There is also a history here. Binance has faced similar claims before, and each time the data turned out to be something other than a fresh breach of its systems. In September 2024, a claim circulated about 12.8 million Binance records. In March 2025, a listing appeared for Gemini and Binance data. In March 2026, about 1.5 million accounts were reportedly attributed to credential stuffing and scraping — attacks that reuse passwords leaked elsewhere, rather than a break-in at the exchange. The pattern is consistent: big numbers, alarming contents, and on inspection, recycled or repackaged data rather than a new compromise.

That history does not settle this case. But it does explain why Binance's first response was scepticism rather than alarm, and why the burden of proof sits with the seller. A seller asking $900,000 for data it will not let anyone verify is asking buyers — and the public — to take the claim on trust. In the market for stolen data, trust is exactly what is in short supply.

How This Differs From the 29 October Wallet Hack

The confusion around this claim is understandable, because it arrived about a week after one of the largest crypto thefts in history. But the two events are different in kind, and keeping them separate matters.

	29 October wallet hack	335 million records claim
What was allegedly taken	Cryptocurrency from Binance's hot wallets	Customer records: IDs, passwords, private keys
Amount	About $6.3 billion in impact, per Binance	$900,000 asking price for the dataset
Status	Confirmed by Binance; incident report published 3 November	Unverified; Binance calls it likely a scam
Attribution	FBI attributed it to TraderTraitor, a North Korean group	Seller uses the ShinyHunters name; impersonation suspected
User funds	Binance says user losses are covered by its SAFU fund and company funds	No loss of funds claimed or confirmed

The 29 October attack, as described in Binance's own incident report, began with a tampered software download in June and a fake job interview in September, and ended with unauthorised withdrawals from the exchange's wallet signing service. About $2.85 billion was frozen or intercepted, and Binance has said it will cover user losses. The records claim, by contrast, involves no confirmed theft of anything — only an advertisement for data that may or may not exist, and may or may not have come from Binance.

The distinction matters for users. After a wallet hack, the question is whether the exchange can make users whole and whether withdrawals are safe. After a data-sale claim, the question is whether your personal information is circulating and whether scammers will use it to target you. Different risks, different checks, and — for now — very different levels of evidence.

Why Fake Breach Claims Appear After a Real Hack

There is a reason this claim surfaced when it did. A major hack creates exactly the conditions in which a fake data sale can thrive: public attention, user anxiety, and a news cycle hungry for the next development.

First, attention is a currency. A listing that mentions Binance in the week after a $6.3 billion theft gets read, shared and reported in a way that the same listing would not have a month earlier. The seller does not need the data to be real to benefit from the attention — the listing itself, and the threat to publish, can be enough to attract a buyer or extort a payment.

Second, anxiety makes people click. Users who have just learned that their exchange was hacked are primed to open emails and messages about their accounts. Scammers know this, and the days after a big hack are peak season for phishing: fake "verify your account" emails, fake support accounts, and fake data-breach warnings that ask users to "confirm" their credentials. A widely reported data-sale claim, real or not, gives those phishing messages a plausible story to ride on.

Third, the data itself may be real but old. Infostealer malware — software that quietly steals saved passwords, browser cookies and crypto wallet details from infected computers — has been harvesting credentials for years. A seller can bundle credentials stolen from users' own devices, label the bundle with a famous exchange's name, and sell it as a "Binance breach". The data is real, the label is not, and the buyers cannot easily tell the difference. Binance's own note about past listings points at exactly this pattern.

That is why the right response to a claim like this is not panic, and not dismissal either. It is verification: check your own account, check your own devices, and treat every message about the claim as potentially hostile until proven otherwise.

What Indian Users Should Check Right Now

India adds a wrinkle to this story. Binance's website and app are blocked in India after the Financial Intelligence Unit-India (FIU-IND) issued compliance notices to offshore exchanges, so many Indian users access their accounts through the app they already have installed or through other routes. That makes them harder to reach through official channels — and easier to reach through unofficial ones, such as Telegram groups and WhatsApp forwards, where fake breach warnings spread fast.

Here is a practical checklist, in order:

1. Go to the official app or website yourself. Do not click any link in an email, SMS or message about the claim, even if it looks like it comes from Binance. Open the app you already have, or type the address yourself. If a message says your account is affected and asks you to log in through its link, treat the message as a scam.

2. Turn on two-factor authentication. If your account does not already use an authenticator app for two-factor authentication, enable it now. SMS-based codes are better than nothing, but an authenticator app is harder for an attacker to intercept. This single step blocks most credential-stuffing attacks, which rely on a stolen password alone.

3. Review recent logins and sessions. Binance shows recent login activity and active sessions. Look for logins from places or devices you do not recognise, and end any session you cannot account for. If you see a login you did not make, change your password immediately and contact support through the official app.

4. Check and revoke API keys. If you have ever connected a trading bot, a portfolio tracker or any third-party tool to your account, review the API keys linked to it. Revoke any key you do not recognise or no longer use, and make sure no key has withdrawal permissions unless you specifically need it to. The SignalPlus incident earlier in November showed how a compromised third-party connection can put accounts at risk even when the exchange itself is not breached.

5. Change reused passwords. If you have used your Binance password on any other website, change it — on Binance and on the other site. Credential stuffing works because people reuse passwords; a password leaked from an unrelated service can unlock an exchange account if it is the same one.

6. Scan your own devices. Because infostealer malware is the most likely source of any real data in a listing like this, run a reputable antivirus or malware scan on the computer and phone you use for crypto. If you have downloaded software from unofficial sources, pirated tools, or "free" trading bots, remove them.

7. Watch for phishing, not just for a breach. In the days after a claim like this, expect a wave of fake emails and messages claiming your data was leaked and asking you to "verify" your account or "claim" compensation. Binance will not ask for your password or your seed phrase by email or message. If you receive a suspicious message, report it through Binance's official support channels and, in India, through the National Cyber Crime Reporting Portal at cybercrime.gov.in or the 1930 helpline.

Tax note: crypto tax rules can change — the 30% rate and 1% TDS described here were current as of September 2026. Verify the latest rules before filing.

What to Watch Next

Three things will determine whether this claim fades or grows.

The first is Binance's investigation. The exchange has said its assessment so far is preliminary, which means it is still looking. If Binance confirms that no breach occurred, the claim will likely fade, as similar claims have before. If it finds evidence that some data is genuine — even if that data came from users' devices rather than its systems — it will need to say so, and to say what it is doing about it.

The second is whether anyone verifies the data. Threat-monitoring firms and security researchers sometimes obtain samples of advertised datasets and check them against known breaches. If a sample surfaces and the records check out as genuine Binance data, the story changes completely. If the sample turns out to be recycled from older leaks, the claim collapses. Until then, the honest description is "unverified".

The third is the phishing wave. Whether or not the data is real, scammers will use the headlines. The practical test for ordinary users is not the fate of the listing but the safety of their own accounts: strong, unique passwords, two-factor authentication, and a habit of never clicking account-related links in messages. Those defences work against real breaches and fake ones alike.

The Bottom Line

A seller using the ShinyHunters name is offering what it claims is 335.9 million Binance user records for $900,000. Binance says its preliminary review found no evidence of a systems breach and calls the listing likely a scam. Founder Changpeng Zhao has dismissed it publicly, security firms have documented the listing but cannot verify the data, and the 335.9 million line count does not by itself establish that 335.9 million people were affected. The claim is separate from the confirmed 29 October wallet theft, and it should be judged on its own thin evidence.

For Indian users, the useful response is not to argue about whether the data is real. It is to treat the claim as a reminder: check your account through official channels, enable two-factor authentication, revoke API keys you do not use, stop reusing passwords, and assume that any message about the claim asking you to click a link is a scam until proven otherwise. If the data turns out to be genuine, those steps protect you. If it turns out to be a scam, they protect you anyway.

Keep Learning

• How the Binance Hack Happened: Fake Job Interview and Tampered Download
• SignalPlus Hack: API Keys Revoked After Third-Party Breach
• What Is the SAFU Fund? Binance's Safety Net Explained