Binance Data Sale Claim Rides the US$6.34 Billion Heist

Binance was one day past losing about US$6.34 billion to North Korean threat actors when the first advertisement for its customers' data appeared. On October 30, a Telegram post headlined "335 Million" and "Binance Data" offered the set. Brandefense captured four versions through November 2 under three different account names, with prices ranging from a negotiable US$500,000 to US$900,000.

On November 4, a seller using the ShinyHunters name posted the offer on PwsForums, a newly emerged cyber crime forum. That post offered 335.9 million lines of Binance data for US$900,000 in bitcoin or Monero, and repeated the advertisement's two-word ultimatum to the exchange, pay or leak.

The listing claims email addresses, phone numbers, account passwords, transaction histories, know-your-customer (KYC) documents including ID cards and passports, wallet private keys, internal infrastructure details, and data on assets in Binance's hot wallet. Binance calls it likely a scam. The exchange says it found no evidence of compromise in its systems, KYC data, credentials, private keys, or infrastructure. It says it does not store passwords in plaintext or hold the private keys for users' external wallets, and it notes the listing names jurisdictions where Binance no longer operates.

The listing contradicts itself before any sample analysis begins. A seller holding working private keys for Binance users would drain the wallets rather than sell the keys for US$900,000, a point other forum users raised.

The seller also placed the sample behind a forum paywall, so ThreatMon could not analyze it. Anyone wanting to verify the claim must first pay the seller. The count measures "lines," not customers, as eSecurity Planet notes. The total even exceeds the 323 million users Binance reported in July.

The advertisement itself says its samples are split because they come from different countries, a description fitting a compilation from several sources. Lines are the standard unit of infostealer credential dumps, with one website, username, and password on each line. Malware on users' own devices typically harvests them. Binance says similar past listings often traced back to that source. Stolen log-in data from infected personal computers can be real and damaging without any breach of Binance itself.

Use of the ShinyHunters name proves nothing about the seller. Hive Pro documents threat actors hijacking the brand, including a reseller of infostealer data posing as ShinyHunters. The real ShinyHunters has publicly disowned sales channels and dedicated leak sites trading on its name. BleepingComputer describes the Binance seller as believed to impersonate ShinyHunters, and no public statement from ShinyHunters on the post has been reported. The brand, built on extortion through mass data theft and examined in my analysis of how ShinyHunters survived every arrest, lends instant credibility to anyone willing to borrow it.

The timing is the clearest sign of opportunism. Binance spent the days after the theft explaining, in a November 3 incident report, how a fake job interview gave PRESSURE CHOLLIMA (aka TraderTraitor) access to its wallet signing service. A breach claim arriving inside that news cycle borrows its attention. I have tracked the breach from the twenty-minute drain through Binance's own explanation and the FBI's attribution to North Korea.

Customers primed to believe Binance is compromised are easier to phish, and the phishing arrived within days. On November 1, Bitdefender's Antispam Lab caught a "SAFU Reconciliation Desk" email. It borrowed the name of Binance's Secure Asset Fund for Users and promised reissued bitcoin for a verification fee of 0.0042 bitcoin. A second campaign impersonated Trust Wallet and threatened account suspension unless recipients verified their wallets. Binance has warned users against anyone requesting passwords, two-factor codes, seed phrases, or private keys.

Binance's own history argues against dismissing the listing outright. In August 2019, an extortionist demanded 300 bitcoin and leaked photos of users holding identity documents. Binance first questioned their authenticity, then said the images appeared to date from February 2018, when it used a third-party vendor for KYC verification.

No independent analysis of the current sample has been published. Brandefense judges the mix of identity documents, wallet keys, and infrastructure details more consistent with recycled data or a scam than a single extraction. A dataset can still combine recycled infostealer logs with fragments from a genuine third-party compromise. Binance's denial covers its own systems, not every company holding Binance customer data. An exchange whose stolen funds remain only partly frozen has every incentive to close a second front quickly.

The listing exploits a real crisis to sell an unproven one, and the danger to Binance customers lies in the phishing it invites rather than in the dataset itself. I assess with moderate confidence the listing does not reflect a breach of Binance systems, and with low confidence its contents are limited to infostealer logs. I assess with low confidence the seller is affiliated with ShinyHunters.