An advertisement posted from several Telegram accounts offers a set that its text headlines “335 Million” and “Binance Data”. Near-identical text appears under three different account names, so we cannot tell whether one actor or several reposters stand behind it. The Binance data sale claim appeared on 30 October 2026 and was posted again on 1 and 2 November. Everything in it is the advertisement’s own text.
This explainer sets the claim next to what can be checked. We name no seller, channel or contact, link no listing and repeat no personal data. Where we judge how likely a claim is, we say “our reading”.
What Does the Advertisement Claim?
The advertisement says the data comes from Binance and totals “335,900,000 Lines”. It lists what the records are said to hold. The list names hot-wallet assets, internal infrastructure information, wallet private keys, identity documents (ID card or passport), passwords, emails, phones and transaction history.
The two 2 November versions ask $900k in crypto, with room to negotiate; one of them reads “Price: $900k USD” and the other “maybe we’ll drop the price to $500k”. The 1 November version says “Negotiable $500k”. These are the advertisement’s figures, not a price anyone paid.
The text also carries the line “BINANCE HAS 2 OPTIONS LEFT, PAY OR LEAK”, which frames the post as pressure on Binance as well as a sale. One version also claims an earlier sale to a buyer. We cannot check that claim.
- Dates seen.
- 30 October, 1 November and 2 November 2026 (four versions of one advertisement).
- Platform.
- Telegram.
- Claimed size.
- “335,900,000 Lines”.
- Claimed contents.
- Hot-wallet assets, internal infrastructure information, private keys, KYC documents, passwords, emails and phones, transaction history.
- Advertised price.
- Stated in the advertisement; see the text.
- Binance statement on this sale.
- The Binance pages we opened on 3 November 2026 (About, announcements) carry no statement on this sale.
- Confirmation of the data.
- We have seen none, and we did not open or test any sample as of 3 November 2026.
What Do the Posts and Binance’s Pages Show?
Brandefense Blackhole holds three Telegram posts that match “335 Million”, dated 30 October and 2 November 2026. A search for “Binance Data” returns 9 posts in a search covering 25 October to 3 November. Four of them are versions of this advertisement. The others are unrelated, such as a news link, generic lead-selling ads and a warning-style post from another account that mentions the listing, which we do not rely on.
Brandefense has not verified this data. We only report what the posts say.
The same search shows a forum post of 27 October that offers a much smaller Binance-related user list for one country. A search for “Binance KYC” returns 15 posts from 25 October to 2 November, mostly requests to buy or sell verified accounts. Our reading is that this is a separate, long-running market and not evidence for the 335 million claim.
Binance’s About page, opened on 3 November 2026, says in a leadership biography that Binance reached “250 million registered users by January 2025”. It gives no daily-user figure and no later count. The advertisement says “Nearly 400 million users use Binance every day”.
Our reading: these are different measures (registered versus daily) and different dates, so the page neither confirms nor refutes the advertisement’s figure. What we can say is that a listing of 335.9 million “lines” is a line count, not a count of people.
The Binance pages we opened on 3 November 2026 (About, announcements) carry no statement on this sale. Those pages did not return a full item list, so this is not proof that Binance has said nothing elsewhere.
How Believable Is the Claim?
The claim is large, round and bundles very different kinds of data. Our reading is that this mix is a warning sign, because no single system normally holds wallet keys, identity scans and server details together. The sections below weigh each part.
- Transaction historyOur reading: could come from older or partial sources; unverifiedWho can verify itBinance and affected users
- Emails, phones, passwordsOur reading: often repackaged from earlier unrelated leaks; unverifiedWho can verify itBinance and affected users
- KYC identity documentsThe most serious part if real; the advertisement shows no proof hereWho can verify itBinance and affected users
- Private keys and hot-wallet assetsOur reading: an actor holding these would normally use them, not sell them in an open chatWho can verify itBinance onlyLeast plausible as sold
Our reading starts with the numbers. Duplicates, mixed countries and older leaked lists could all inflate a line count of this size, and the advertisement gives no way to rule that out.
The advertisement also says the data is split into samples “because they come from different countries”. That wording fits a set assembled from several places. Our reading is that it does not fit a single extraction from one system.
Our reading: the private-key claim is the weakest. Keys that control funds are worth far more when used than when sold for the advertised price. An actor who really held them would risk the chain being emptied and the sale being pointless. For background on how these listings work, read our anatomy of a dark web listing and the guide to the dark web.
The timing matters too. A new, loud listing can borrow attention from other news. Our reading is that sellers and scammers use timing, and nothing in our sources links this listing to any other event.
What Could Go Wrong for Users Even If the Data Is Not Real?
A claim can cause harm without being true. Our reading is that the most likely effect is phishing that uses the “leak” as a pretext. Messages may say your Binance account was exposed and ask you to verify, reset a password or move funds. Learn the basics in our entry on phishing.
Real exposure of identity documents would raise a different risk, identity fraud, which lasts long after a password is changed. Nothing confirms that here. Our advice below covers both cases, and our entry on a data breach explains what such events involve.
- Do not follow “leak” messagesOpen the official app or site by typing the address yourself. Treat any message, call or ad about a leak as hostile until you confirm it there.
- Turn on strong sign-inUse an authenticator app or a hardware key, not SMS. Enable the anti-phishing code and withdrawal address allow-list if your account offers them.
- Change reused passwordsIf you reused a Binance password anywhere, change it everywhere and use a password manager.
- Watch for identity misuseIf you shared an ID document with an exchange, watch for unexpected accounts or credit checks in your name.
- Brief staff and customersSecurity teams that serve crypto users can warn them about leak-themed phishing and share one official contact.
- Wait for the sourceTreat the sale as unverified until Binance or an independent party confirms it.
What Is Still Unknown?
We do not know whether any real Binance data exists behind the listing or how old it is. We also do not know if the advertisement’s samples match any Binance system. The next useful facts would come from Binance or from independent analysts who have examined a sample safely. We will update this article if a named party confirms or denies the claim.