# Binance denies data breach after alleged ShinyHunters-branded data sale claim (335M user records)

> A threat actor using the 'ShinyHunters' handle on a newly emerged underground forum offered records claimed to belong to 335 million Binance users for $900,000. BleepingComputer reports the actor is believed to be impersonating the ShinyHunters extortion gang. Binance says it found no evidence of a breach and that the listing is likely a scam.

- **Published:** 2026-11-09T16:38:17Z
- **Last reviewed:** 2026-11-09T16:38:17Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5567
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5567.png
- **ID:** TL-2026-5567
- **Severity:** MEDIUM
- **Category:** DATA_BREACH
- **Status:** MONITORING
- **Detections:** 9 (1 shown free below) · **IOCs:** 9 (2 shown free below)

## Description

On 2026-11-09 BleepingComputer reported that an actor using the 'ShinyHunters' handle on a newly emerged, unnamed underground cybercrime forum is offering for $900,000 data allegedly covering 335 million Binance users. The claimed contents are KYC documents, internal infrastructure information, account passwords, crypto wallet private keys, transaction history, emails and phone numbers. The actor issued a 'pay or leak' ultimatum, saying Binance has 'two options left: pay or leak'.

Binance states it found no evidence that its systems, customer KYC data, account credentials or wallet private keys were compromised, and calls the listing likely a scam. It says it does not hold private keys for users' external wallets, does not store passwords in plaintext, and no longer operates in some jurisdictions the actor referenced. Binance also notes that similar past listings have often involved infostealer malware data collected from users' own devices. Another forum user publicly questioned why an actor holding the private keys to all wallets would sell the data rather than use it.

BleepingComputer says the actor is believed to be impersonating ShinyHunters but cites no specific evidence in the article. Public reporting shows ShinyHunters has been widely impersonated: Hive Pro describes 'brand hijacking' by unaffiliated actors and by 'DB+ Collector', which resells infostealer-log data rather than breaching systems, and ShinyHunters has publicly disowned certain channels and leak sites using its name. Not every ShinyHunters-linked claim is fake, so attribution here is unverified.

The source provides no IOCs, no CVE and no evidence of exploitation. The practical risk to defenders and customers is credential-stuffing and phishing exposure if any portion of the data is real or recycled from earlier leaks or infostealer logs. Binance has had earlier alleged leak claims it disputed (12.8M records in September 2024, a Gemini/Binance listing in March 2025, 1.5M accounts reportedly attributed to credential stuffing and scraping in March 2026). Separately, Binance disclosed a real, unrelated October 2026 wallet-infrastructure theft that the FBI attributed to TraderTraitor (DPRK). There is no evidence linking that incident to this listing. This record is tracked for monitoring and should be escalated if independent verification or new IOCs emerge.

## MITRE ATT&CK

- T1585 Establish Accounts
- T1684.001 Impersonation
- T1657 Financial Theft
- T1555.003 Credentials from Web Browsers
- T1005 Data from Local System
- T1078 Valid Accounts
- T1110.004 Credential Stuffing
- T1566 Phishing

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Credential Stuffing Burst Against Exchange Login Endpoint (Binance Data-Sale Claim Fallout)** (`TL-2026-5567-SPL-001`)

Detects credential stuffing (T1110.004) against a login/auth endpoint: one source IP sending many POSTs across many distinct accounts with a very high failure ratio inside a 10-minute window. TL-2026-5567 is an unverified 335M-record Binance data-sale claim; Binance says similar past listings were recycled infostealer logs and credential stuffing, so the real defender risk is replay of leaked or stolen credentials against exchange or customer login surfaces. Behaviour-first; no IOC dependency.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1110.004, T1078
- **Data sources:** web_access_logs: index=web sourcetype=access_combined, W3CIISLog, webserver
- **Severity:** medium
- **Confidence:** medium

### Splunk SPL

```spl
index=web sourcetype=access_combined earliest=-1h method=POST (uri_path="*/login*" OR uri_path="*/signin*" OR uri_path="*/auth*")
| bin _time span=10m
| eval failed=if(match(status,"^(401|403|429)$"),1,0), succeeded=if(match(status,"^(200|302)$"),1,0)
| stats count AS attempts, sum(failed) AS failures, sum(succeeded) AS successes, dc(user) AS distinct_accounts, dc(useragent) AS distinct_user_agents by _time, src_ip
| where attempts>=50 AND distinct_accounts>=20 AND failures/attempts>=0.8
| eval mitre="T1110.004,T1078", threat_id="TL-2026-5567"
| sort - attempts
| table _time src_ip attempts failures successes distinct_accounts distinct_user_agents mitre threat_id
```

### Microsoft KQL

```kql
// Credential stuffing burst against a login endpoint (T1110.004) - TL-2026-5567
W3CIISLog
| where TimeGenerated > ago(1h)
| where csMethod == "POST" and (csUriStem has_any ("/login", "/signin", "/auth"))
| summarize Attempts=count(), Failures=countif(scStatus in (401, 403, 429)), Successes=countif(scStatus in (200, 302)), DistinctAccounts=dcount(csUserName), DistinctUserAgents=dcount(csUserAgent) by cIP, bin(TimeGenerated, 10m)
| where Attempts >= 50 and DistinctAccounts >= 20 and todouble(Failures) / Attempts >= 0.8
| extend Technique="T1110.004,T1078", ThreatId="TL-2026-5567"
| project TimeGenerated, cIP, Attempts, Failures, Successes, DistinctAccounts, DistinctUserAgents, Technique, ThreatId
```

### Sigma

```yaml
title: Exchange Login POST Failure
name: tl5567_login_failure
status: experimental
description: Failed POST to a login, signin or auth endpoint. Building block for the credential stuffing correlation below.
logsource:
    category: webserver
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem|contains:
            - '/login'
            - '/signin'
            - '/auth'
        sc-status:
            - 401
            - 403
            - 429
    condition: selection
level: informational
---
title: Credential Stuffing Against Exchange Login Endpoint
id: 6f1c2a54-3b7e-4d2a-9c11-5a8e0b7d4101
status: experimental
description: One client IP failing logins for 20 or more distinct accounts within 10 minutes, consistent with credential stuffing using leaked or infostealer-sourced credentials (TL-2026-5567).
references:
    - https://www.bleepingcomputer.com/news/security/binance-denies-data-breach-after-alleged-shinyhunters-claims/
author: Threadlinqs Team
date: 2026/11/09
tags:
    - attack.credential-access
    - attack.t1110.004
    - attack.initial-access
    - attack.t1078
correlation:
    type: value_count
    rules:
        - tl5567_login_failure
    group-by:
        - c-ip
    timespan: 10m
    condition:
        gte: 20
        field: cs-username
falsepositives:
    - Corporate NAT or VPN egress where many users fail logins simultaneously (for example after a password policy change)
    - Load-testing or synthetic monitoring against the login endpoint
level: medium
```

**Known false positives:**

- Corporate NAT, VPN or mobile-carrier CGNAT egress where many legitimate users fail logins at once
- Load tests or synthetic monitoring hitting the login endpoint with rotating test accounts

**Tuning notes:** Assumes fields uri_path, method, status, user, useragent and src_ip; remap to your web or WAF sourcetype and your real auth paths. Raise attempts/distinct_accounts thresholds for high-traffic NAT egress; allow-list monitoring IPs. If your app returns HTTP 200 for failed logins, key on the response body or an app error code instead of status. Pair with TL-2026-5567-SPL-003 for post-login takeover activity.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Entra ID Password Spray / Credential Stuffing Followed By Successful Sign-In From Same IP (locked: unlock with TL Creds)
- Browser Credential Store and Wallet Extension Data Copied or Archived by Non-Browser Process (locked: unlock with TL Creds)
- Inbound Email Impersonating Binance: Lookalike Sender or URL, or Breach-Lure Subject (locked: unlock with TL Creds)
- Web Proxy Access To Binance Lookalike Domain Outside Official Domains (locked: unlock with TL Creds)
- DNS Lookup of ShinyHunters-Brand Domains From Hive Pro Advisory ([indicator], [indicator]) (locked: unlock with TL Creds)
- Infostealer Log Artifacts Written To Disk (Passwords.txt, Autofills.txt, CreditCards.txt) (locked: unlock with TL Creds)
- Account Takeover Sequence: New Device, Security Hardening Change, Rapid Withdrawal (locked: unlock with TL Creds)
- Non-Browser Process Reading Browser Credential Stores and Wallet Extension Data (Infostealer Behaviour) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (2 of 9)

Defanged, TLP:CLEAR.

- Domain: `shinyhunte[.]rs`
- Domain: `breachforums[.]hn`

Full set of 9 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Binance denies data breach after alleged ShinyHunters claims](https://www.bleepingcomputer.com/news/security/binance-denies-data-breach-after-alleged-shinyhunters-claims/)
- [FBI links $6.3 billion Binance crypto heist to North Korean hackers](https://www.bleepingcomputer.com/news/security/fbi-links-63-billion-binance-crypto-heist-to-north-korean-hackers/)
- [Binance says fake job interview led to $6.3 billion crypto heist](https://www.bleepingcomputer.com/news/security/binance-says-fake-job-interview-led-to-63-billion-crypto-heist/)
- [Brand Hijack in Cybercrime: Who Is Pretending to Be ShinyHunters?](https://www.hivepro.com/threat-advisory/brand-hijack-in-cybercrime-who-is-pretending-to-be-shinyhunters/)
- [Binance denies user data breach allegations (12.8M records claim)](https://forklog.com/en/binance-denies-user-data-breach-allegations/)
- [Sextortion scammers are exploiting ShinyHunters data leaks](https://www.malwarebytes.com/blog/scams/2026/07/sextortion-scammers-are-exploiting-shinyhunters-data-leaks)
- [Hackers selling leaked Gemini, Binance user information](https://cointelegraph.com/news/hackers-selling-leaked-gemini-binance-user-information)
- [ShinyHunters impersonation statement (databreaches.net)](https://databreaches.net/?p=123582)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5567