Telegram advertisements that appeared from 30 October to 2 November 2026 claim a Binance haul of 335.9 million "lines," including KYC documents, passwords, emails, phones, transaction history, infrastructure data, hot-wallet assets and private keys. Some versions invoke ShinyHunters and a pay-or-leak frame. Asking prices in the ad copy moved between $500,000 and $900,000. The catalog entry records this as an unverified claim. recordsAffected stays 0. 335.9 million is an advertiser line count, not a confirmed unique-people census. Binance pages reviewed on 3 November did not address this sale.
This is not the company's 29 October notice about unauthorised withdrawals after a DevOps laptop was compromised. That October incident is a confirmed operations event with no personal-data census in the sources used here. Keep both rows. An older April forum listing of about 1.5 million alleged leads is a third, also unverified, row.
What is being claimed in the Binance data theft ads?
The ads bundle data types that do not usually live in one system: wallet keys, identity scans and mailboxes. Brandefense's public read of four versions of the advertisement is that the mix is a warning sign, closer to recycled files or a scam listing than to one clean extraction. That is an analyst view, not a Binance confirmation and not a proof that nothing was stolen. The catalog labels the whole thing unverified until Binance or a regulator matches a sample.
ShinyHunters has a long 2026 leak-site list. A Telegram handle and a brand name in an ad are not a forensic attribution. Do not treat the 335.9 million figure as Have I Been Pwned volume. Line counts pad easily.
Phishing will quote this headline either way. "Binance will credit your account if you paste a seed phrase" is hostile. Official recovery, if any, will not start from a random Telegram user.
Binance's own About copy has cited on the order of 250 million registered users in an earlier year. An ad that claims nearly 400 million daily users and 335.9 million stolen lines is mixing measures. Brandefense notes that a line is not a person. The October laptop incident, by contrast, came with a company operations notice and a recovery story. This Telegram sale has neither.
What data is alleged?
Claimed, unverified: hot-wallet assets, internal infrastructure information, wallet private keys, identity documents, passwords, emails, phones, transaction history, organised by country. No sample is independently confirmed in the writeup we used. Do not follow dump links. If Binance later says a specific field set left, the catalog should move. Until then, do not freeze a credit file solely because of this ad.
One version of the ad also claims an earlier sale to a buyer. That claim is as unchecked as the rest. Contact handles from the ads are omitted here on purpose. Publishing them only helps the people running the listing.
Who would be affected if it were real?
Anyone with a Binance account, in the advertisement's telling, across more than 170 countries. That is the claim. It is not a notified set. People who only used Binance through a third-party front are not automatically in a file nobody has matched. The 29 October withdrawal incident is a different population: users whose assets sat in affected hot wallets, with Binance saying user funds are being recovered.
What should I do?
- Open Binance only from a bookmark or the official app. Ignore "pay or leak" Telegram users.
- Turn on an authenticator app. Do not paste seed phrases into a "KYC re-verify" page that arrived this week.
- If you still use a password on Binance, move to passkeys or an app-based second factor. The ad claims passwords. That claim is unverified and reuse is still the usual failure.
- Watch for lookalike support chat that quotes the 335.9 million figure. That number is from the ad, not from Binance.
- Keep this distinct from the October laptop incident. If Binance publishes a user-data notice, that notice replaces this claim row's empty census.
The October withdrawal post is the company-confirmed contrast. The April forum-leads post is the earlier unverified listing, at a much smaller claimed size.
Frequently asked questions
Did Binance confirm 335.9 million records were stolen?
No. The figure is from Telegram advertisements. Brandefense reported that Binance pages it opened on 3 November 2026 did not address the sale.
Is this the October hot-wallet incident?
No. The 29 October company notice is about unauthorised withdrawals after a DevOps laptop was compromised. It is a separate catalog row.
Should I treat my KYC as leaked?
Not on this advertisement alone. Watch for phishing that pretends the leak is proven. Wait for a Binance notice before changing how you store identity documents.
Why is recordsAffected 0?
Because 335.9 million is an unverified line count. Storing it as a census would treat an ad as a fact.
Who is asking for money?
The ads. Prices in the copy moved between $500,000 and $900,000. Nobody should pay them, and this catalog does not list contact handles.
Sourcing note: dates, the 335.9 million line count, the field list in the ads, the $500k to $900k prices, and the absence of a Binance statement on 3 November come from Brandefense's public writeup of the Telegram advertisements. Attribution to ShinyHunters is the ads' own labelling.