Binance Denies Purported ShinyHunters 335.9M Record Claim

A seller is demanding $900,000 for what it claims is 335.9 million lines of stolen Binance data. The bigger question is whether the information is genuine.

A threat actor using the ShinyHunters name has advertised the purported dataset on an underground cybercrime forum, claiming it contains customer records, internal information, and cryptocurrency-related credentials. Binance disputes the allegation, saying its investigation has found no evidence of a related breach.

The claim follows separate reports of a major cryptocurrency theft involving Binance, but no evidence presented in the draft connects the two incidents. For now, the advertised data remains unverified, and the seller's identity is also uncertain.

Per BleepingComputer, the seller's demand is crystal clear: pay or have your data leaked. That isn't surprising, given that that's the modus operandi of the infamous ShinyHunters group. Still, we don't know if it's truly them, or someone trying to use their brand.

Binance is in the news, again

On Oct. 29, Binance suffered a major security breach after North Korean hackers compromised its infrastructure and stole approximately $6.34 billion in digital assets. 

The exchange has since been working to contain the damage, recover assets, and restore affected funds, even as North Korea has rejected the attribution.

This time, a threat actor claiming affiliation with the ShinyHunters group is advertising 335.9 million lines of purported Binance user data on an underground cybercrime forum. In a Nov. 8 post, cybersecurity monitoring firm ThreatMon reported that the listing claims to contain information belonging to users across approximately 170 countries.

The advertised dataset allegedly contains email addresses, phone numbers, account passwords, KYC documents, and transaction histories. It also claims to include cryptocurrency wallet private keys, information about assets held in Binance's hot wallets, and internal infrastructure details.

The seller is demanding $900,000 in Bitcoin or Monero for the purported dataset, threatening to publish the information if Binance refuses to pay. 

However, the advertised figure represents data lines, not a verified count of unique customers, and the contents have not been independently authenticated.

Password and pricing claims raise questions

Looking at the claims, several things don't quite make sense.

The first is the password claim. Standard cybersecurity practice requires hashing passwords. This means that even if attackers obtain a password database, they don't automatically get readable passwords, which is why attackers often rely on social engineering and phishing to get users to hand over their actual credentials.

Then there's the amount. While this isn't necessarily a significant red flag on its own, $900,000 seems relatively low for an extortion campaign involving 335.9 million lines of allegedly stolen data. 

Most established hacking groups, particularly one claiming to be ShinyHunters, are not typically associated with starting their demands that low for an alleged haul of this size. It doesn't prove the listing is fraudulent, but it is another reason to question the seller's credibility.

Binance disputes claims involving wallet private keys

The third is something anyone who understands how cryptocurrency works would find questionable: the claim of possessing users' wallet private keys. 

Another questionable element is the seller's claim to possess cryptocurrency wallet private keys. The company said it does not control the private keys associated with users' external wallets. However, that distinction does not address every possible type of cryptocurrency key or credential.

Without independently verified samples, it remains unclear what the seller means by private keys, whether the advertised information is authentic, or whether any of it could provide access to funds.

In response to a user on X requesting transparency over the allegations, Binance Customer Support said that based on the description and sample information reviewed so far, the listing appeared more likely to be a scam.

Taken together, these inconsistencies make the alleged breach difficult to substantiate. While they don't independently prove that the listing is fabricated, they give us several reasons to question whether the seller ever gained access to Binance's systems in the first place.

How Binance users can protect their accounts

Even if the breach claim turns out to be false, Binance users aren't necessarily safe. The goal may go beyond extorting an exchange that recently suffered a multibillion-dollar security incident. 

Attackers could exploit the publicity to put customers in panic mode, then use that fear to launch phishing campaigns targeting their accounts. A worried user is more likely to click a message promising urgent account recovery or security assistance.

If you use Binance, here are some precautions:

• Avoid unsolicited links: Don't click security alerts or account recovery links sent through emails, SMS, or social media. Access Binance directly through its official app or website.
• Enable 2FA: Use an authenticator app, passkey, or other supported means.
• Use a unique password: Change reused passwords to reduce the risk of credential-stuffing attacks.
• Review account activity: Check login sessions, registered devices, and withdrawal activity for anything unfamiliar.
• Beware of fake support agents: Never share passwords, 2FA codes, or private keys with anyone claiming to represent Binance.
• Secure your devices: Keep your software updated and avoid downloading applications or attachments from untrusted sources.

For now, Binance users should treat any messages referencing the alleged breach with caution, particularly those urging immediate password resets, identity verification, or wallet transfers. 

Such requests could be attempts to exploit the publicity surrounding the claim, regardless of whether the advertised dataset is genuine.

The bigger question remains whether the seller possesses authentic Binance information at all. With the exchange disputing the allegations and no independent verification of the advertised records, there is currently insufficient evidence to establish that a new breach occurred. 

Until more evidence emerges, the claim remains an unverified allegation rather than a confirmed security incident.

In other news: Japan's MS&AD Insurance Group is dealing with a growing cybersecurity headache after multiple data breaches pushed its reported exposure past 1 million records, including customer information compromised through a third-party roadside assistance provider and a separate business portal attack.