2026 Binance — criminal forum “leads” listings (~1.5M rows) flagged as possibly scraped/agglomerated rather than verified core breach
Data compromised
Emails, passwords, phones, geographic fields, MFA status, balances, or KYC flags per advertised columns (trust unknown)
Technical writeup
April 2026 open-source summaries described forum marketing of roughly 1.5 million Binance-oriented “lead” rows with contacts, passwords, MFA status, balances, KYC cues, etc. Commentary from independent intel accounts stressed that such bundles can mix infostealers, credential stuffing dumps, scraped marketing data, or outright fabrication—and that Binance’s published incident narrative historically distinguished large-scale scraping or credential stuffing from internal database compromises. Maintain skeptical handling until authoritative exchange confirmation aligns with sourcing.
Root cause
Marketplace-listed dataset of unclear provenance—possible scraping/stuffing/aggregation versus direct DB theft