Skip to navigation

Threat reportData BreachTL-2026-5567

Binance denies data breach after alleged ShinyHunters-branded data sale claim (335M user records)

mediumMONITORING

A threat actor using the 'ShinyHunters' handle on a newly emerged underground forum offered records claimed to belong to 335 million Binance users for $900,000. BleepingComputer reports the actor is believed to be impersonating the ShinyHunters extortion gang. Binance says it found no evidence of a breach and that the listing is likely a scam.

Key facts

IdentifiersTL-2026-5567
SeverityMEDIUM
First disclosed
Affected productsBinance Binance user accounts and platform (claimed; denied by vendor)
MalwareGeneric infostealer malware (family unspecified)
MITRE ATT&CK techniquesT1005 Data from Local System, T1078 Valid Accounts, T1110.004 Credential Stuffing, T1555.003 Credentials from Web Browsers, T1566 Phishing, T1585 Establish Accounts, T1657 Financial Theft, T1684.001 Impersonation
MotivationFINANCIAL
Target sectorsfinance, cryptocurrency
Target regionsGlobal
Detection rules9 (1 shown free)
Sources8 cited sources

Detection coverage

As of 2026-11-09, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5567 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Credential Stuffing Burst Against Exchange Login Endpoint (Binance Data-Sale Claim Fallout)

Detects credential stuffing (T1110.004) against a login/auth endpoint: one source IP sending many POSTs across many distinct accounts with a very high failure ratio inside a 10-minute window. TL-2026-5567 is an unverified 335M-record Binance data-sale claim; Binance says similar past listings were recycled infostealer logs and credential stuffing, so the real defender risk is replay of leaked or stolen credentials against exchange or customer login surfaces. Behaviour-first; no IOC dependency.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1110.004, T1078
  • Data sources: web_access_logs: index=web sourcetype=access_combined, W3CIISLog, webserver
  • Severity: medium
  • Confidence: medium

Splunk SPL

index=web sourcetype=access_combined earliest=-1h method=POST (uri_path="*/login*" OR uri_path="*/signin*" OR uri_path="*/auth*")
| bin _time span=10m
| eval failed=if(match(status,"^(401|403|429)$"),1,0), succeeded=if(match(status,"^(200|302)$"),1,0)
| stats count AS attempts, sum(failed) AS failures, sum(succeeded) AS successes, dc(user) AS distinct_accounts, dc(useragent) AS distinct_user_agents by _time, src_ip
| where attempts>=50 AND distinct_accounts>=20 AND failures/attempts>=0.8
| eval mitre="T1110.004,T1078", threat_id="TL-2026-5567"
| sort - attempts
| table _time src_ip attempts failures successes distinct_accounts distinct_user_agents mitre threat_id

Microsoft KQL

// Credential stuffing burst against a login endpoint (T1110.004) - TL-2026-5567
W3CIISLog
| where TimeGenerated > ago(1h)
| where csMethod == "POST" and (csUriStem has_any ("/login", "/signin", "/auth"))
| summarize Attempts=count(), Failures=countif(scStatus in (401, 403, 429)), Successes=countif(scStatus in (200, 302)), DistinctAccounts=dcount(csUserName), DistinctUserAgents=dcount(csUserAgent) by cIP, bin(TimeGenerated, 10m)
| where Attempts >= 50 and DistinctAccounts >= 20 and todouble(Failures) / Attempts >= 0.8
| extend Technique="T1110.004,T1078", ThreatId="TL-2026-5567"
| project TimeGenerated, cIP, Attempts, Failures, Successes, DistinctAccounts, DistinctUserAgents, Technique, ThreatId

Sigma

title: Exchange Login POST Failure
name: tl5567_login_failure
status: experimental
description: Failed POST to a login, signin or auth endpoint. Building block for the credential stuffing correlation below.
logsource:
    category: webserver
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem|contains:
            - '/login'
            - '/signin'
            - '/auth'
        sc-status:
            - 401
            - 403
            - 429
    condition: selection
level: informational
---
title: Credential Stuffing Against Exchange Login Endpoint
id: 6f1c2a54-3b7e-4d2a-9c11-5a8e0b7d4101
status: experimental
description: One client IP failing logins for 20 or more distinct accounts within 10 minutes, consistent with credential stuffing using leaked or infostealer-sourced credentials (TL-2026-5567).
references:
    - https://www.bleepingcomputer.com/news/security/binance-denies-data-breach-after-alleged-shinyhunters-claims/
author: Threadlinqs Team
date: 2026/11/09
tags:
    - attack.credential-access
    - attack.t1110.004
    - attack.initial-access
    - attack.t1078
correlation:
    type: value_count
    rules:
        - tl5567_login_failure
    group-by:
        - c-ip
    timespan: 10m
    condition:
        gte: 20
        field: cs-username
falsepositives:
    - Corporate NAT or VPN egress where many users fail logins simultaneously (for example after a password policy change)
    - Load-testing or synthetic monitoring against the login endpoint
level: medium

Known false positives:

  • Corporate NAT, VPN or mobile-carrier CGNAT egress where many legitimate users fail logins at once
  • Load tests or synthetic monitoring hitting the login endpoint with rotating test accounts

Tuning notes: Assumes fields uri_path, method, status, user, useragent and src_ip; remap to your web or WAF sourcetype and your real auth paths. Raise attempts/distinct_accounts thresholds for high-traffic NAT egress; allow-list monitoring IPs. If your app returns HTTP 200 for failed logins, key on the response body or an app error code instead of status. Pair with TL-2026-5567-SPL-003 for post-login takeover activity.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Entra ID Password Spray / Credential Stuffing Followed By Successful Sign-In From Same IP · unlock with TL Creds
  • Browser Credential Store and Wallet Extension Data Copied or Archived by Non-Browser Process · unlock with TL Creds
  • Inbound Email Impersonating Binance: Lookalike Sender or URL, or Breach-Lure Subject · unlock with TL Creds
  • Web Proxy Access To Binance Lookalike Domain Outside Official Domains · unlock with TL Creds
  • DNS Lookup of ShinyHunters-Brand Domains From Hive Pro Advisory ([indicator], [indicator]) · unlock with TL Creds
  • Infostealer Log Artifacts Written To Disk (Passwords.txt, Autofills.txt, CreditCards.txt) · unlock with TL Creds
  • Account Takeover Sequence: New Device, Security Hardening Change, Rapid Withdrawal · unlock with TL Creds
  • Non-Browser Process Reading Browser Credential Stores and Wallet Extension Data (Infostealer Behaviour) · unlock with TL Creds

Indicators of compromise

As of 2026-11-09, Threadlinqs Intelligence tracks 9 indicators of compromise for TL-2026-5567.

Sample indicators (2 of 9)

  • Domain: shinyhunte[.]rs
  • Domain: breachforums[.]hn

Defanged, TLP:CLEAR. Full set of 9 indicators: unlock with TL Creds.

9 indicators of compromise · unlock with TL Creds. Compare plans

Community OSINT corroboration

1 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Technical analysis

On 2026-11-09 BleepingComputer reported that an actor using the 'ShinyHunters' handle on a newly emerged, unnamed underground cybercrime forum is offering for $900,000 data allegedly covering 335 million Binance users. The claimed contents are KYC documents, internal infrastructure information, account passwords, crypto wallet private keys, transaction history, emails and phone numbers. The actor issued a 'pay or leak' ultimatum, saying Binance has 'two options left: pay or leak'.

Binance states it found no evidence that its systems, customer KYC data, account credentials or wallet private keys were compromised, and calls the listing likely a scam. It says it does not hold private keys for users' external wallets, does not store passwords in plaintext, and no longer operates in some jurisdictions the actor referenced. Binance also notes that similar past listings have often involved infostealer malware data collected from users' own devices. Another forum user publicly questioned why an actor holding the private keys to all wallets would sell the data rather than use it.

BleepingComputer says the actor is believed to be impersonating ShinyHunters but cites no specific evidence in the article. Public reporting shows ShinyHunters has been widely impersonated: Hive Pro describes 'brand hijacking' by unaffiliated actors and by 'DB+ Collector', which resells infostealer-log data rather than breaching systems, and ShinyHunters has publicly disowned certain channels and leak sites using its name. Not every ShinyHunters-linked claim is fake, so attribution here is unverified.

The source provides no IOCs, no CVE and no evidence of exploitation. The practical risk to defenders and customers is credential-stuffing and phishing exposure if any portion of the data is real or recycled from earlier leaks or infostealer logs. Binance has had earlier alleged leak claims it disputed (12.8M records in September 2024, a Gemini/Binance listing in March 2025, 1.5M accounts reportedly attributed to credential stuffing and scraping in March 2026). Separately, Binance disclosed a real, unrelated October 2026 wallet-infrastructure theft that the FBI attributed to TraderTraitor (DPRK). There is no evidence linking that incident to this listing. This record is tracked for monitoring and should be escalated if independent verification or new IOCs emerge.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System

Initial Access

T1078 Valid Accounts; T1566 Phishing

Credential Access

T1110.004 Credential Stuffing; T1555.003 Credentials from Web Browsers

Resource Development

T1585 Establish Accounts

Impact

T1657 Financial Theft

Defense Evasion

T1684.001 Impersonation

Remediation

Immediate actions

  • Treat the claim as unverified; monitor the forum listing and any sample data for authenticity before acting
  • Advise customers never to share passwords, 2FA codes, seed phrases or private keys
  • Warn users to watch for phishing and extortion emails referencing the claimed breach
  • Check exposed-credential feeds and infostealer-log sources for Binance-related credentials

Workarounds

  • Rotate passwords and revoke API keys on any account suspected of appearing in infostealer logs
  • Use hardware wallets and never type seed phrases into websites or applications

Longer-term hardening

  • Enforce phishing-resistant MFA and withdrawal allow-listing for exchange accounts
  • Monitor for credential-stuffing against login endpoints
  • Deploy endpoint protection that detects infostealer malware on user and employee devices
  • Pre-stage a verification process to validate leak-sale samples against watermarked or canary records

Affected and fixed versions

  • Binance — Binance user accounts and platform (claimed; denied by vendor)

Timeline

  • ForkLog reports an unidentified seller offering 12.8 million alleged Binance user records on a dark web forum; Binance denies a leak of user data.
  • March 2025: dark web listings claim Gemini and Binance user data; Binance says no leak from its systems and attributes the data to phishing (month-level date per secondary reporting).
  • March 2026: VECERT reports an actor named PexRat selling 1.5 million Binance user records, reportedly obtained via credential stuffing and scraping rather than server compromise (month-level date per secondary reporting).
  • Separate incident: attackers steal over $6 billion in crypto from Binance wallet infrastructure after compromising employee systems; later attributed by the FBI to TraderTraitor. No evidence links it to this listing.
  • FBI attributes the October heist to North Korea's TraderTraitor (Lazarus/APT38) and publishes 628 associated cryptocurrency addresses (context only).
  • Binance publishes its incident report on the October heist (context only; unrelated to the 335M-record claim).
  • Binance states it found no evidence of a breach, calls the listing likely a scam, and notes similar listings often involve infostealer data from users' own devices.
  • BleepingComputer reports an actor using the 'ShinyHunters' handle on a newly emerged forum offering 335 million claimed Binance user records for $900,000 with a 'pay or leak' ultimatum.

Sources cited

Previous and next in data breach

Drafted by the Threadlinqs research pipeline from 8 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats