Binance has denied claims that hackers stole the records of 335 million of its users, calling a forum listing that offered the alleged data for $900,000 likely a scam. The exchange said its preliminary review found no evidence that its systems had been breached.

The listing appeared on a newly emerged underground cybercrime forum under the ShinyHunters name and was then shared on X. The seller claimed to hold 335.9 million lines of data covering customers in about 170 countries, including identity documents, email addresses, phone numbers, account passwords, transaction histories and crypto wallet private keys. Payment of $900,000 in Bitcoin or Monero was demanded, with a threat to release the data if Binance did not pay.

Binance says the listing does not add up

Binance said it had found no evidence that its systems, customer identity documents, account credentials, wallet private keys or internal infrastructure had been compromised in connection with the listing. A spokesperson told BleepingComputer that the listing was likely a scam, and that similar past listings had often involved data gathered by infostealer malware from users' own devices rather than a breach of an exchange's systems.

The exchange also pointed to details in the listing that it said were inconsistent with how it stores user data. Binance said it does not hold private keys for users' external wallets, does not store user passwords in plaintext, and no longer operates in some of the jurisdictions the seller cited. Founder Changpeng Zhao, known as CZ, dismissed the claim on X on 9 November, calling it obviously fake and a scam.

335.9 million lines is not 335.9 million people

Threat intelligence firm ThreatMon, which documented the listing, noted that the alleged breach had not been independently verified and flagged the claims about hot wallets and keys as unverified. Analysts also cautioned that 335.9 million lines of data would not necessarily mean 335.9 million individual customers were affected, since one person can appear in many lines of leaked data.

The claim comes about a week after Binance confirmed a separate and far larger incident: North Korean hackers stole about $6.34 billion in cryptocurrency from its wallets after tricking a DevOps employee into installing malware during a fake job interview. The FBI has attributed that theft to TraderTraitor, the North Korean state-backed group also tracked as Lazarus Group. That confirmed theft is a different incident from the forum listing Binance is now disputing, and the exchange has stressed that the two should not be confused.

What users should do

Binance said it was continuing to investigate the claim, but its position so far is that there is no sign its platform was breached. Users should still treat the episode as a reminder to use strong, unique passwords, turn on two-factor authentication and be wary of phishing messages that exploit breach headlines. Anyone who reused a Binance password elsewhere should change it, and users should only trust security notices published through Binance's official channels.