Binance Denies Leak of 335.9 Million User Records

The cryptocurrency exchange Binance found no evidence of a new breach of its systems after announcements surfaced about the sale of 335.9 million records allegedly containing users' personal data. A company representative reported this on November 9, 2026, commenting on the results of a preliminary investigation.

According to Binance, the offer to sell the information may be fraudulent. The investigation continues, and the authenticity of the advertised data set has not been independently confirmed.

What is known about the alleged sale of Binance data

Information about the announcement was spread by ThreatMon, a company specializing in monitoring cyber threats. According to their information, the seller, linked to the group ShinyHunters, claimed to have 335,900,000 rows of data related to Binance users from approximately 170 countries.

The list of alleged data included email addresses, phone numbers, passwords, identity verification documents, transaction history, and private keys of crypto wallets.

The seller demanded $900,000 in Bitcoin or Monero for the data set and threatened to publish the information if payment was not made.

However, the number of rows in the announcement does not mean that the information pertains to the same number of unique users. Furthermore, it is unknown whether the data exists in the claimed volume and whether it is related to Binance's current systems.

Why Binance doubts the credibility of the announcement

A Binance representative stated that the initial investigation did not reveal any signs of compromise of user documents, account credentials, private keys, or the exchange's internal infrastructure in connection with the published announcement.

The company pointed out several inconsistencies in the description of the alleged database.

Firstly, the seller claims to have users' passwords in plain text. Binance stated that it does not store account passwords in such a format.

Secondly, the announcement contains information about allegedly stolen private keys of external crypto wallets. According to the exchange, such keys are not under its control.

Additional doubts were raised by the mention of countries where Binance no longer provides services.

The company also suggested that information in such announcements may have been obtained using infostealers – malicious programs designed to steal data directly from users' devices.

In such a case, credentials could end up with attackers without breaching the cryptocurrency exchange's infrastructure. However, the origin of the specific advertised set has not yet been established.

The announcement is not related to the confirmed breach on October 29

The emergence of new reports of a leak followed a separate Binance security incident that occurred on October 29, 2026.

At that time, attackers gained unauthorized access to the transaction signing infrastructure and transferred cryptocurrency from the exchange's hot wallets. According to Binance's report on November 3, the incident affected digital assets worth approximately $6.34 billion.

The company reported that approximately $2.85 billion was frozen or intercepted. Additionally, Binance committed to covering financial losses from its own resources.

As of October 31, according to the exchange's report, 98% of the affected tokens had been replenished.

The October incident involved unauthorized cryptocurrency transfers. The new announcement suggests the theft of user records and credentials. There is no evidence of a connection between these events at the time of publication.

What Binance users are advised to do

Binance urged users to exercise caution when receiving messages related to account security and alleged data leaks.

Particular attention should be paid to emails and notifications that urge immediate identity verification, clicking on links, or providing confidential information.

Passwords, two-factor authentication codes, seed phrases, and private keys should not be shared with third parties. It is recommended to check account status and official notifications directly through the Binance app or website.

The exchange continues to investigate the announcements of the alleged data sale. Final results of the investigation were not published as of November 9.