Ing. Calogero Bono
Binance has denied suffering a new data breach. A user on a underground forum, calling themselves ShinyHunters, claims to hold the data of 335 million customers and demands $900,000 to keep it from being leaked. The exchange says it is likely a scam. The story comes just days after a theft of about $6.3 billion attributed to North Korean hackers, which is why it has drawn attention.
A few terms before we get into the facts. Data breach is a system intrusion that leads to the theft of data. KYC (Know Your Customer) refers to the identity documents an exchange collects to verify its customers. Infostealer is malware that steals passwords and data directly from the victim's device. Meme coin is a cryptocurrency created as a joke or for hype, and easy to launch. Liquidity pool is a reserve of tokens on a decentralized exchange, used for trading.
What happened with the alleged Binance data breach?
According to BleepingComputer, a malicious actor put up for sale on a newly created forum what they say are the records of 335 million users. The list includes KYC documents, information about internal infrastructure, passwords, wallet private keys, transaction history, emails and phone numbers.
The demand is $900,000. The author writes that Binance has "two options" and sums them up as "pay or leak". As reported by Punto Informatico, that figure would be exactly the ransom the exchange is supposed to pay.
Why does Binance call it a scam?
A spokesperson told BleepingComputer that they found no evidence that systems, KYC data, credentials or private keys were compromised. They add that similar cases have often involved data collected by infostealers on users' devices, not a breach of the exchange.
Binance also points to inconsistencies in the announcement.
- It does not hold the private keys of users' external wallets.
- It does not store passwords in plain text.
- It no longer operates in some of the countries mentioned in the post.
Other forum members were skeptical too. They asked why someone who really had the keys to all wallets would sell the data, when they could simply drain them.
What is the link with the $6.3 billion theft?
No proven link. The context does weigh, however. Binance confirmed that North Korean hackers tricked an employee into installing malware during a fake job interview, stealing about $6.34 billion. We covered it in this article on the fake interview.
The FBI attributed the attack to TraderTraitor, a group backed by the North Korean state, also known as Lazarus Group, Jade Sleet and APT38. We also discuss it in the one on the reopening of withdrawals. The group was already linked to the $1.5 billion theft from Bybit in February 2025.
How are the stolen funds being laundered?
Experts at Elliptic identified a technique that uses meme coins. About $430,000 was laundered on the NEAR blockchain through a liquidity pool on a decentralized exchange.
The criminals created six meme coins and swapped their tokens for real assets in the pool. In this way they moved funds between wallets through the pool. The transactions remain on the public blockchain and can be traced, but the technique slows down investigations.
Limits to know
There is no independent verification of the data being sold. The denial comes from Binance, an interested party, and no source has shown samples of the data. We do not know who is really behind the post. Punto Informatico speaks of strong suspicion, not certainty. The possibility remains that old data, collected by infostealers, is circulating. The picture could change if verifiable samples appear.
What changes for those working with digital
For anyone using an exchange or managing crypto at work, the most concrete risk is phishing. Binance advises never sharing passwords, 2FA codes, seed phrases or private keys. Anyone receiving emails citing an alleged data theft should be wary.
This also applies to those who handle customer data. If someone writes to you claiming to have your data and asks for a ransom, verify before paying. If a breach has actually occurred, the obligations described in our GDPR breach notification guide apply.
Our take
The denial is plausible, but trusting the company's word is not enough. The technical clues are solid, especially the paradox of the private keys. The timing is striking, however. After a record theft, anyone can exploit fear to extort money or sow doubt. The real risk remains user trust, which erodes even with a false alarm. That is why clear and verifiable communication is needed, not just denials.
Frequently asked questions
Did Binance suffer a new data breach?
No, according to Binance. The exchange says it found no evidence that its systems were compromised. There is currently no independent verification.
Who is ShinyHunters?
It is a known extortion group in the cybercrime world. Sources believe the author of the post is using the name to exploit its reputation.
How much are the criminals asking for?
They ask for $900,000. The post claims 335 million users are affected and threatens to release the data if Binance does not pay.
Could the data come from somewhere else?
It is possible. Binance points out that similar cases have often involved data stolen by infostealers from users' devices, not from its own systems.
What should a Binance user do?
Never share passwords, 2FA codes, seed phrases or private keys. Stay alert to phishing attempts, a warning Binance itself has issued.
What to watch for in the coming weeks on Binance
We need proof, not announcements. Verifiable samples of the data and the progress of the investigation into the $6.3 billion theft are what matter.
- Check whether samples of the data appear on the forum and whether independent experts verify them.
- Follow updates from Binance and the FBI on attribution and recovery of the funds.
- Read Binance's initial account of the Mac malware, discussed in the 9to5Mac podcast.
