Binance Disputes 335M-Record Breach Claim as Scam, Cites Inconsistencies
Binance and founder Changpeng Zhao have called a claimed theft of 335.9 million user records a likely scam, citing inconsistencies in a $900,000 listing. The claim is separate from a $6.34 billion wallet-signing theft Binance disclosed on Oct. 29, which it attributed to North Korea.
Written by CoinArticle’s AI Newsroom · from 2 cited sources. How we work
The Breach Claim and Binance's Response
Binance has disputed a listing that claims to offer 335.9 million user records, including identity documents, credentials and private keys, for $900,000. A spokesperson said the company was actively investigating and had reviewed the description and sample information available at that stage. The exchange said the listing contained several inconsistencies, including references to jurisdictions where Binance no longer operates.
Binance founder Changpeng Zhao went further in a post on X on Nov. 9, calling the claim "obviously fake/scam." He argued that anyone holding usable private keys would move the cryptocurrency rather than attempt to sell the information, and said media outlets had reported the claim for its headline value.
Where the Assessments Diverge
The security firms that examined the listing do not fully agree on how credible it is. ThreatMon described the allegations about hot-wallet contents and private keys as unverified. Brandefense said the mixed contents and private-key offer looked more consistent with recycled information or a scam, and noted it had not opened or tested a sample as of Nov. 3. A sample was reportedly placed behind a forum paywall, so the underlying data has not been independently verified by the outlets covering it.
Binance has stated that it does not store account passwords in plaintext or hold private keys for customers' external wallets. Those statements, along with the seller's demand for payment in Bitcoin or Monero, are the main grounds on which the exchange and its critics have questioned the claim.
A Separate, Confirmed Theft
The breach listing should not be confused with a separate incident. In its Nov. 3 incident report, Binance described a $6.34 billion theft on Oct. 29 involving unauthorized access to its wallet signing service. The exchange traced the intrusion through compromised employee devices and stolen deployment credentials, and said attackers used Ethereum permissions to keep moving assets after normal withdrawals were suspended. The final unauthorized transfer, 2,961.9 ETH, settled at 23:56 UTC on Oct. 29. Binance cited the FBI's attribution of that attack to North Korea.
Ongoing Phishing Concerns
Binance's September warning about phishing texts is relevant context for users. The messages alleged suspicious logins or account changes and directed recipients through shortened links. The exchange said it never asks customers to verify or secure their accounts through text-message links.
Why It Matters
For Traders
Binance-related headlines may move sentiment short term, but the disputed listing is unverified while the confirmed $6.34 billion theft is the material event to track.
For Investors
The gap between a confirmed nine-figure-plus exploit and an unverified data claim highlights custody and operational security as a core risk factor in centralized exchange exposure.
For Builders
The reported attack path through wallet signing services and stolen deployment credentials underscores the need for strict access controls and monitoring on signing infrastructure.
This article is for information only and is not financial advice. Read the full disclaimer.
