--- title: Binance denies data breach after alleged ShinyHunters claims description: Binance has denied a new breach claim from a threat actor using the 'ShinyHunters' handle on an underground forum. The actor claimed to be selling records of... canonical: https://daily.dev/posts/binance-denies-data-breach-after-alleged-shinyhunters-claims-lnuzmbjpl twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Binance denies data breach after alleged ShinyHunters claims | daily.dev og:description: Binance has denied a new breach claim from a threat actor using the 'ShinyHunters' handle on an underground forum. The actor claimed to be selling records of... og:url: https://daily.dev/posts/binance-denies-data-breach-after-alleged-shinyhunters-claims-lnuzmbjpl og:image: https://api.daily.dev/og/posts/lNuzmBjpL.png og:image:alt: Binance denies data breach after alleged ShinyHunters claims og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Binance denies data breach after alleged ShinyHunters claims **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 3 min read · 0 upvotes · 0 comments ## Summary Binance has denied a new breach claim from a threat actor using the 'ShinyHunters' handle on an underground forum. The actor claimed to be selling records of 335 million Binance users, including KYC documents, passwords, wallet private keys, and transaction history, for $900,000. Binance says it found no evidence of a breach and calls it likely a scam, noting it doesn't store private keys for external wallets or passwords in plaintext. The company suggests past similar listings came from infostealer malware on users' own devices, not a Binance breach. This follows Binance's confirmed $6.34 billion theft by North Korean hackers via a fake job interview. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Did Binance actually suffer a data breach from ShinyHunters? Binance denies any breach occurred. A threat actor using the 'ShinyHunters' handle claimed to be selling records of 335 million Binance users, including KYC documents, passwords, wallet private keys and transaction history, for $900,000, but Binance found no evidence its systems, KYC data, credentials, or wallet keys were compromised, calling the listing likely a scam. _Security teams evaluating exchange breach claims can follow verified crypto security incidents on daily.dev._ ### How do infostealer malware data dumps get mistaken for real company data breaches? Similar past listings attributed to breaches have often actually involved infostealer malware that collected data from users' own devices, not from a breach of the company's systems. Binance pointed to this pattern when explaining why it doubts the ShinyHunters-linked seller's claims about its 335-million-record listing are genuine. _Developers investigating credential leaks can track how infostealer-sourced data gets misattributed on daily.dev._ ### How did North Korean hackers steal $6.34 billion from Binance? North Korean hackers tricked a Binance employee into installing malware during a fake job interview, which let them compromise the company's wallet infrastructure and steal about $6.34 billion in cryptocurrency. The FBI attributed the attack to the TraderTraitor group, also known as Lazarus Group, Jade Sleet, and APT38, previously linked to the $1.5 billion Bybit hack. _Teams hardening hiring and devops workflows against state-backed attackers follow incidents like this on daily.dev._ --- Tags: [#crypto](https://daily.dev/tags/crypto), [#phishing](https://daily.dev/tags/phishing), [#data-breach](https://daily.dev/tags/data-breach) [View this post on daily.dev](https://daily.dev/posts/binance-denies-data-breach-after-alleged-shinyhunters-claims-lnuzmbjpl) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Binance denies data breach after alleged ShinyHunters claims","url":"https://daily.dev/posts/binance-denies-data-breach-after-alleged-shinyhunters-claims-lnuzmbjpl","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/binance-denies-data-breach-after-alleged-shinyhunters-claims-lnuzmbjpl"},"datePublished":"2026-11-09T16:13:52.362Z","dateModified":"2026-11-09T16:14:32.577Z","description":"Binance has denied a new breach claim from a threat actor using the 'ShinyHunters' handle on an underground forum. The actor claimed to be selling records of...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/6c528eddb79ce42971b2ff7be85252b8?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/6c528eddb79ce42971b2ff7be85252b8?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/binance-denies-data-breach-after-alleged-shinyhunters-claims-lnuzmbjpl","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"crypto,phishing,data-breach","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"Binance denies data breach after alleged ShinyHunters claims"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/binance-denies-data-breach-after-alleged-shinyhunters-claims-lnuzmbjpl#faq","mainEntity":[{"@type":"Question","name":"Did Binance actually suffer a data breach from ShinyHunters?","acceptedAnswer":{"@type":"Answer","text":"Binance denies any breach occurred. A threat actor using the 'ShinyHunters' handle claimed to be selling records of 335 million Binance users, including KYC documents, passwords, wallet private keys and transaction history, for $900,000, but Binance found no evidence its systems, KYC data, credentials, or wallet keys were compromised, calling the listing likely a scam. Security teams evaluating exchange breach claims can follow verified crypto security incidents on daily.dev."}},{"@type":"Question","name":"How do infostealer malware data dumps get mistaken for real company data breaches?","acceptedAnswer":{"@type":"Answer","text":"Similar past listings attributed to breaches have often actually involved infostealer malware that collected data from users' own devices, not from a breach of the company's systems. Binance pointed to this pattern when explaining why it doubts the ShinyHunters-linked seller's claims about its 335-million-record listing are genuine. Developers investigating credential leaks can track how infostealer-sourced data gets misattributed on daily.dev."}},{"@type":"Question","name":"How did North Korean hackers steal $6.34 billion from Binance?","acceptedAnswer":{"@type":"Answer","text":"North Korean hackers tricked a Binance employee into installing malware during a fake job interview, which let them compromise the company's wallet infrastructure and steal about $6.34 billion in cryptocurrency. The FBI attributed the attack to the TraderTraitor group, also known as Lazarus Group, Jade Sleet, and APT38, previously linked to the $1.5 billion Bybit hack. Teams hardening hiring and devops workflows against state-backed attackers follow incidents like this on daily.dev."}}]} ```