CZ Dismisses Claim of 335 Million Stolen Binance Records as Scam

CZ Rejects the 335 Million-Record Listing

Binance founder Changpeng Zhao has dismissed an underground listing claiming 335 million user records were stolen from the exchange, calling the offer “obviously fake/scam” in a Nov. 9 post on X. The advertisement, published under the ShinyHunters name, offered a dataset of 335,900,000 lines said to cover customers in approximately 170 countries. ThreatMon, a threat-monitoring account, documented the listing and described its advertised contents: identity cards and passports, email addresses, phone numbers, account passwords, transaction histories and internal infrastructure details. The seller claimed to hold private keys for customers' external wallets and information about assets held in Binance's hot wallets. The asking price was $900,000 in Bitcoin or Monero, accompanied by a threat to publish the material unless the exchange paid. A sample of the data was reportedly placed behind a forum paywall. ThreatMon's own account stated the alleged breach had not been independently verified and specifically flagged the hot-wallet and key claims as unverified. Zhao argued the offer fails a basic logic test: anyone holding usable keys to exchange wallets would simply move the cryptocurrency rather than sell the information for less than $1 million. He said he had seen the claim the previous day and considered its problems obvious at that point. “Saw it yesterday, thought it was obvious, but still many media went with it for the headlines,” he wrote. His post quoted ThreatMon's description of the listing but did not name individual publications or identify particular headlines. He offered an argument against the seller's key claim without publishing a technical examination of the advertised records, leaving the dataset's contents untested in public.

@cz_binance · X post

Nov. 9 post on X.

View on X

Binance's Review Found No System Breach

The exchange had already pushed back before its founder spoke. In a statement issued through its customer-support account on Nov. 9, Binance said samples examined in its preliminary review did not confirm any breach of its systems and that the listing appeared to be a fraud attempt. A company spokesperson said the investigation was active and that the description and sample information available so far had been reviewed. The exchange identified several inconsistencies between the listing and its actual practices. It does not store account passwords in plaintext and does not hold keys for customers' external wallets, and the advertisement referenced jurisdictions where Binance no longer operates. The company also suggested that similar past advertisements had involved information gathered by infostealer malware from individual users' devices, while stating this did not establish the current dataset came from the same source. Security firm Brandefense added historical context: it documented four versions of a near-identical advertisement dated Oct. 30 through Nov. 2, appearing under three Telegram account names, and could not determine whether one seller or several reposters stood behind them. The price shifted across versions. A Nov. 1 iteration sought a negotiable $500,000, while two Nov. 2 versions cited $900,000, one suggesting the figure might drop to $500,000. Brandefense judged the mixed contents and the key offer more consistent with recycled information or a scam, and said it had not opened or tested a sample as of Nov. 3. The firm also drew a line the raw number invites readers to blur: 335.9 million lines do not establish that 335.9 million individual customers were affected.

What the Oct. 29 Incident Report Shows

The strongest argument against the listing comes from the last documented attack, which left evidence the current offer lacks. Binance's incident report, published Nov. 3, described a $6.34 billion theft on Oct. 29 involving unauthorized access to its wallet signing service, traced through compromised employee devices and stolen deployment credentials. Attackers used Ethereum permissions to keep moving assets after normal withdrawals were suspended, and the final unauthorized transfer of 2,961.9 ETH settled at 23:56 UTC on Oct. 29. The report cited the FBI's attribution of that attack to North Korea. A genuine compromise, in other words, produces an on-chain record and a documented intrusion path. The ShinyHunters listing instead offers a price, a deadline and a paywalled sample, and the key claim collapses on its own economics, as Zhao noted. Until a verifiable transaction or an authenticated record surfaces, the weight of the evidence, from Binance's review and from the sellers' shifting asking prices, points to a recycled or fabricated dataset.