Binance is actively investigating claims from a notorious extortion group that it has obtained 335 million customer records.
ShinyHunters posted an ad on PwsForums on November 4 claiming it was selling 335.9 million lines of records including private key wallets, user account passwords, transaction histories, email addresses and phone numbers, internal infrastructure information, KYC data including ID cards and passports, and “crypto assets in Binance’s hot wallet.”
It also demanded $900,000 from the cryptocurrency exchange, claiming it had two remaining choices: “pay or leak.”
However, a message sent to a Binance user by the firm’s customer support account on X said that, based on the sample information and the description of the data “this appears likely to be a scam rather than evidence of a Binance systems breach.”
Read more on ShinyHunters: ShinyHunters Claim Hack of Rival Ransomware Gang Clop
“We have found no evidence that Binance systems, customer KYC data, account credentials, wallet private keys, or internal infrastructure information were compromised in connection with this listing,” the message continued.
“Several aspects of this claim are inconsistent with how Binance stores and protects user data: Binance does not store user passwords in plaintext; Binance does not hold private keys for users’ external wallets; and the listing references jurisdictions where Binance no longer operates.”
Binance said that listings similar to this that have appeared in the past were often the result of infostealer malware installed on victims’ devices rather than a breach of the firm’s systems.
However, it urged users to be on the lookout for follow-on phishing attempts seeking passwords, 2FA codes, seed phrases and private keys.
Laundering Activity Continues
In the meantime, Binance continues to deal with the fallout from a huge theft of cryptocurrency from its platform by North Korean actors at the end of October.
The TraderTraitor group stole around $6.3bn in virtual currency from Binance after a months-long, multi-stage attack that involved fake job interviews and zero-day malware.
The group is now trying to launder the stolen funds by creating meme coins to disguise money flows, according to blockchain investigators.
“Anyone can create a new crypto token, and thousands of new tokens appear every day. Most are meme coins: tokens built around a joke, an animal or a celebrity, and traded on hype rather than any underlying use,” explained Elliptic chief scientist and co-founder, Tom Robinson.
“The launderers’ tokens are made to be used once and thrown away. Nobody outside the laundering operation buys them, and their price is whatever the launderers choose to set. That makes them useful as a container, allowing stolen funds to go in on one side of a liquidity pool and come out on the other.”
Image credit: miss.cabul / Shutterstock.com