Binance's Data for Sale? A Listing That Claims More Records Than the Exchange Has Users

1. A sales pitch riding on a heist

The timing is the first tell. On 31 October, two days after attackers drained about $6.34bn from Binance's hot wallets, a member signing as "ShinyHunters" opened a thread titled "335 Million - Binance Data" on a board that calls itself PwsForums. The post promised "335,900,000 Lines" from "around 170 countries": ID cards and passports, passwords, emails and phone numbers, transaction histories, internal infrastructure, a "private key wallet" and even the crypto in Binance's hot wallet. The price: $900,000 in Monero or bitcoin, negotiable, with an ultimatum in capitals: "BINANCE HAS 2 OPTIONS LEFT, PAY OR LEAK".

The threat-intelligence firm ThreatMon, whose watermark covers the screenshot, flagged the listing while warning that it was unverified. Binance answered flatly. Its customer-support account said on 8 November that it had found no evidence of compromise, and a spokesperson told crypto.news and Dataconomy the listing "appears likely to be a scam rather than evidence of a Binance systems breach". To BleepingComputer, the spokesperson added that "similar past listings have often involved infostealer malware data collected from users' own devices". Binance co-founder Changpeng Zhao was blunter on X: "Saw it yesterday, thought it was obvious, but still many media went with it for the headlines," crypto.news reported.

Document

The post: "335 Million - Binance Data"

Forum listing dated 31 October 2026, last post 4 November, as captured in a screenshot watermarked by ThreatMon

Cropped to the postMember label blurred by Le DétroitThreatMon watermark kept

2. An inventory that undercuts itself

Read as a product sheet, the listing contradicts itself. A seller holding the keys to Binance's hot wallet, or to its users' wallets, would not need $900,000 from anyone: the coins would be worth far more and could be moved in minutes, as 29 October showed. One forum member made the point under the post, BleepingComputer reports: "If you hold the private keys to all the wallets, what would be the justification for selling this?" Binance adds that it holds no keys to users' external wallets and does not store passwords in plaintext. Readable logins are, by contrast, what infostealer malware lifts from infected computers: a dump reported in January held about 149 million of them, at least 420,000 for Binance, Cointelegraph reported.

The arithmetic fails too. Binance reported more than 323 million registered users in July; the seller claims 335.9 million lines, more than the entire customer base, while the post's own blurb boasts "nearly 400 million users" a day. At $900,000, each line would fetch about a quarter of a cent, by Le Détroit's calculation: a clearance price for the passports of a top exchange's whole clientele. The seller's profile, as captured, joined the forum in October 2026, and Binance says the country list includes places where it no longer operates.

3. A famous name, often borrowed

ShinyHunters is a real extortion brand, and a borrowed one. Active since at least 2020, it claimed the Tokopedia and Microsoft GitHub thefts and the 2024 Ticketmaster theft through Snowflake accounts, sold AT&T data, and was tied to the 2025 voice-phishing raids on Salesforce customers, later claimed under the "Scattered LAPSUS$ Hunters" banner. Paris police arrested four suspected BreachForums figures, one known as "ShinyHunters", in June 2025; the brand kept posting. Its fame makes it an easy mask: in the PowerSchool and Vercel cases, people using the name were disowned by figures linked to the group, and BleepingComputer says this poster is "believed to impersonate" the gang. Brandefense, a threat-intelligence firm, said it had reviewed four versions of related ads on Telegram, priced from $500,000 to $900,000, and judged the mix closer to "recycled data or a scam than a single data extraction", Dataconomy and crypto.news reported.

4. The real prize is the identity file

Even if this file is junk, the threat aims at the right target. Anti-money-laundering rules oblige exchanges to verify every customer and keep the proof: passport scans, selfies, addresses, sometimes income. The EU will tighten the regime with a single rulebook, the AMLR, from July 2027. Hence a paradox: rules written to stop criminals hiding money force platforms to build the database criminals want most, names, faces and home addresses tied to crypto wealth. In 2019 alleged Binance KYC photos surfaced with a 300 BTC demand; the exchange said they appeared to date from 2018, when it used a third-party verification vendor.

In France the stakes are physical. France's interior minister counted 77 crypto-linked kidnappings and extortion attempts in the first half of 2026 alone, Cointelegraph and CryptoActu reported in July. In February three armed men broke into a building in Val-de-Marne looking for the head of Binance France; police arrested three suspects the same day, The Block and Cointelegraph reported. Court files do not show that every victim was found through a single leak, CryptoActu notes, but a leak "greatly reduces the scouting work".

A confirmed breach would carry obligations: under the GDPR, a company must notify the competent data protection authority without undue delay and, where feasible, within 72 hours of learning of a breach that puts people at risk. Which authority would lead is unclear: the GDPR looks to a company's main EU establishment, and Binance has had no MiCA authorisation since the EU's transition ended on 1 July, when it also stopped signing up new French residents. For users, Binance's own advice holds: never share passwords, 2FA codes, seed phrases or private keys, and treat unsolicited "security" messages as phishing. If the data does come from infostealers, the weak point is the user's own device, where a new password can be stolen again.

5. Le Détroit's reading

Two threats are sharing one headline. The 29 October theft was real, traced on-chain and attributed by the FBI to North Korea's TraderTraitor (see our earlier piece, "The Interview Behind the $6bn Heist"); nothing published links it to this listing. The listing, for now, is a claim without proof, priced like junk and wrapped in a famous name. Its likeliest content, if any, is the stuff of stealer logs and old dumps relabelled "Binance".

But pay-or-leak works even when the data is weak. It trades on fear, and every phishing crew can now write "your Binance data has leaked" with headlines to back it up. The sensible stance is to treat the file as unproven and the phishing as certain, and to ask the harder question the claim raises: how much identity data the anti-money-laundering system should require platforms to keep, and who answers for it when a copy walks out.