Binance founder Changpeng Zhao has dismissed a claim that 335 million user records were stolen as “obviously fake/scam,” challenging the alleged seller’s decision to offer private keys for $900,000 instead of using them to take funds.
Summary
- CZ has rejected the alleged data sale and criticized media coverage of the claim.
- ThreatMon said the listing advertised private keys, identity documents, passwords, and transaction records.
- Binance’s preliminary investigation found no evidence of a compromise connected to the advertised dataset.
- Brandefense documented similar advertisements dating back to October, without confirming the data was genuine.
CZ, responding on X on Nov. 9, argued that anyone possessing usable private keys would move the cryptocurrency instead of trying to sell the information. He said he had seen the claim the previous day and considered its problems obvious.
“Saw it yesterday, thought it was obvious, but still many media went with it for the headlines,” he wrote.
His response quoted ThreatMon’s post describing an underground forum advertisement attributed to ShinyHunters. The monitoring account’s own account of the listing said the alleged breach had not been independently verified.
Binance disputes the alleged 335 million-record breach
Binance had already challenged the advertisement before its founder’s intervention. As previously reported by crypto.news, the exchange’s preliminary review characterized the listing as a likely scam and found no indication that the advertised information demonstrated a breach of its systems.
A spokesperson said the company was actively investigating the claims and had reviewed the description and sample information available at that stage.
The exchange identified several inconsistencies. It said it does not store account passwords in plaintext or hold private keys for customers’ external wallets. The listing referred to jurisdictions where Binance no longer operates, according to the spokesperson.
Binance suggested that similar past advertisements had involved information collected by infostealer malware from individual users’ devices. Its statement did not establish that this particular dataset came from such malware.
The seller claimed 335.9 million lines across 170 countries
ThreatMon’s post described a dataset containing 335,900,000 lines associated with users in approximately 170 countries. The advertised contents included identity cards and passports, email addresses, phone numbers, account passwords, transaction histories, and internal infrastructure details.
The seller purported to hold private wallet keys and information concerning assets in Binance’s hot wallets. According to the monitoring account, the asking price was $900,000 in Bitcoin or Monero, accompanied by a threat to publish the material unless Binance paid.
A sample was reportedly placed behind a forum paywall. ThreatMon specifically described the hot-wallet and private-key allegations as unverified.
CZ’s criticism focused on how outlets handled the claim, but his post did not name individual publications or identify particular headlines. He offered an argument against the seller’s private-key claim, without publishing a technical examination of the advertised records.
Earlier advertisements carried different asking prices
Security firm Brandefense documented four versions of a similar advertisement dated Oct. 30 through Nov. 2. Its research described near-identical wording appearing under three Telegram account names, leaving it unable to determine whether one seller or several reposters were involved.
The advertised price varied. A Nov. 1 version sought a negotiable $500,000, while two Nov. 2 versions mentioned $900,000, with one suggesting the price might fall to $500,000.
Brandefense considered the mixed contents and private-key offer more consistent with recycled information or a scam. The firm said it had not opened or tested a sample as of Nov. 3.
Its analysis distinguished the advertised line count from a count of affected people: 335.9 million lines do not establish that 335.9 million individual customers had information stolen.
October’s wallet attack had a documented transaction trail
In its Nov. 3 incident report, Binance described a separate $6.34 billion theft on Oct. 29 involving unauthorized access to its wallet signing service.
The exchange’s account of the attack traced the intrusion through compromised employee devices and stolen deployment credentials. Its report said attackers used Ethereum permissions to keep moving assets after normal withdrawals were suspended.
Binance reported that the final unauthorized transfer of 2,961.9 ETH settled at 23:56 UTC on Oct. 29. Its report cited the FBI’s attribution of that attack to North Korea.
Separately, Binance’s September warning about phishing texts described messages alleging suspicious logins or account changes and directing recipients through shortened links. The exchange said it never asks customers to verify or secure their accounts through text-message links.
