Rumor vs record: is a hacker really selling 335.9 million Binance user records?
A "pay or leak" ad offering 335.9 million Binance records, private keys included, has been reshared online. We checked each claim against Binance's own pages and a threat intelligence firm's review. Nothing confirms it, and its headline number is close to a counter anyone can read on Binance's homepage.
Key points
- The ad claims 335.9 million lines of Binance data for up to $900,000. Brandefense, a threat intelligence firm, says it had tested no sample and seen no confirmation as of November 3, 2026.
- Binance's homepage showed "336,290,603 users trust us" at 12:44 a.m. ET on November 11. A public counter is not proof of a breach.
- The ad first appeared on October 30 and was reposted November 1 and 2, so it is not new. No Binance page we checked confirms a leak.
Rumor vs record
| What is going around | Verdict | What the record shows |
|---|---|---|
| "A hacker holds 335.9 million Binance user records." | Unverified | Brandefense, which tracked the ad, says it had opened or tested no sample and seen no confirmation as of November 3. The figure sits close to the user counter on Binance's own homepage, so a big round number proves nothing. Source |
| "The data includes wallet private keys, passwords and passports." | Unverified | No sample has been checked. Brandefense rates the private-key claim as the least plausible part and says the mixed contents look more like recycled data or a scam. Binance's November 3 incident report on the October 29 theft does not mention customer data. Source |
| "This is a fresh leak from the last few days." | Misleading | Brandefense dates the first ad to October 30, 2026, with reposts on November 1 and 2 on Telegram. So it was already more than a week old by November 9. Source |
| "Binance has more than 335 million users, so this must be everyone." | Misleading | Binance does publish a user count near that figure: 336,290,603 on its homepage at 12:44 a.m. ET on November 11. Its About page says it had 250 million registered users by January 2025. Matching a public number shows nothing about whether any data was taken. Source |
Why we did this check
An ad selling what it calls Binance's user database has been posted on Telegram since October 30, 2026, and reshared since. It lists ID cards, passwords, emails, phone numbers, transaction history and even wallet private keys (the secret codes that control crypto). The asking price was up to $900,000, and it warned that Binance has two options: "pay or leak."
The timing made it easy to believe. Binance says about $6.34 billion in digital assets were hit in an October 29 security incident, and many users are already nervous. So we checked each line against records we could open ourselves. For an earlier Binance edition of this series, see Rumor vs record: did hackers pay $15 to drain $2.5 billion from Binance?
What the record shows
Brandefense's review, published November 3, found the ad first appeared on October 30 and was reposted on November 1 and 2 from several Telegram accounts. The asking price moved between $500,000 and $900,000 across versions. Brandefense says it had not opened or tested any sample and had seen no confirmation. Its view is that the claim looks more like recycled data or a scam than one clean theft.
Binance's own November 3 report on the October 29 attack describes stolen funds from internal wallet systems. It does not say customer records were taken. The About page carries no notice of a new breach.
The number anyone can copy
The ad's 335.9 million lines sound huge, but Binance shows a live counter on its homepage. At 12:44 a.m. ET on November 11 it read 336,290,603 users. Anyone can copy that figure into a sales post. A matching number is a reason to be more careful, not less.
What users can do
Old leaks of emails and phone numbers are often reused for phishing. Expect fake "Binance security" messages that ask you to log in, share a 2FA code (the one-time login code from your phone) or move funds. No real support agent needs your password, 2FA code or seed phrase. Type the address yourself and do not click links in DMs or replies.
LC Insight analysis
This section is our reading of the facts above, not a statement of fact.
- We think the ad worked because it arrived after a real, large Binance hack. A true event made an unproven claim easier to share.
- The likely risk for users is phishing, not a database dump. Even recycled contact data is enough for convincing fake support messages.
What's next
- Whether any researcher publishes a tested sample of the data
- Any formal Binance notice on its blog or announcements page
- A rise in fake Binance support messages in the coming days
Disclaimer. This article is based on public information and the sources listed below as of the update time shown. It is for information only and is not investment, legal or tax advice. Figures may change as companies and authorities publish new data.
