# Hackers claim to hold Binance user data and demand $900,000 as the fallout from the $6.3 billion theft spreads

No independent source has confirmed the extortion claim, Binance's chief financial officer is leaving, and investigators say about $3.1 billion of stolen funds still sits in wallets linked to the attackers.

- Published: 2026-11-09T05:43:40.268Z
- Canonical: https://polylog.news/crypto/2026-11-09/hackers-claim-to-hold-binance-user-data-and-demand-900-000-a
- Publisher: Polylog (Crypto desk)
- Section: crypto
- Sources: [Polylog editors](https://polylog.news), [Rekt News](https://www.rekt.news/), [Cointelegraph](https://cointelegraph.com/news/binance-hackers-8-weeks-access-63b-exploit-security-alliance), [Al Jazeera](https://www.aljazeera.com/news/2026/10/30/binance-says-6-3bn-stolen-in-biggest-crypto-heist-in-history-what-we-know), [NBC News](https://www.nbcnews.com/business/business-news/fbi-says-north-korea-was-6-billion-binance-crypto-hack-rcna606758), [TechCrunch](https://techcrunch.com/2026/11/07/binance-cfo-is-leaving-to-pursue-a-new-venture-after-6-3-billion-hack/), [The Crypto Times](https://www.cryptotimes.io/2026/11/07/binance-hackers-convert-124m-into-1650-bitcoin-as-3-1b-stays-in-linked-wallets/), [Thoropass](https://www.thoropass.com/blog/binance-breach-2026)

A group posting on the darknet says it holds 335.9 million records taken from Binance and is demanding $900,000 not to publish them, according to [a French-language post from Goku Crypto News](https://t.me/GokuCryptoNews/21254). The desk found no independent confirmation and no published sample. The figure of 335 million matches the registered-user total Binance itself reports, so the number alone proves nothing. Binance has [denied earlier darknet claims of the same kind](https://ru.tradingview.com/news/cointelegraph%3A5dc2e2c91094b%3A0-darkweb-actors-claim-to-have-over-100k-of-gemini-binance-user-info), telling Cointelegraph that no data had leaked from its systems.

The claim comes 11 days after the October 29 theft, which [rekt.news](https://www.rekt.news/) and other outlets have examined in detail. Blockchain analytics firm TRM Labs said an attacker moved about $6.36 billion out of Binance wallets on ten blockchains, most of it in roughly 20 minutes. [Al Jazeera](https://www.aljazeera.com/news/2026/10/30/binance-says-6-3bn-stolen-in-biggest-crypto-heist-in-history-what-we-know) reported that Binance itself calls it the biggest crypto theft on record. Binance says the attack began with social engineering: a fake job interview infected an employee's device, and the stolen credentials gave the attackers access to its wallet infrastructure. The nonprofit Security Alliance (SEAL) [estimates](https://cointelegraph.com/news/binance-hackers-8-weeks-access-63b-exploit-security-alliance) the intruders were inside Binance's systems for about eight weeks before they moved the funds. One [technical write-up](https://www.thoropass.com/blog/binance-breach-2026) says the last step used Ethereum's EIP-7702 delegation feature to give an attacker-controlled contract partial control of a Binance hot wallet.

The Federal Bureau of Investigation (FBI) [attributed the theft](https://www.nbcnews.com/business/business-news/fbi-says-north-korea-was-6-billion-binance-crypto-hack-rcna606758) to TraderTraitor, a North Korean state hacking group. Chainalysis and TRM Labs also attribute it to TraderTraitor with high confidence. Kim Yo Jong, the sister of North Korea's leader, dismissed the accusation. According to Reuters figures cited by Al Jazeera, about $3 billion has been frozen, including more than $2.3 billion frozen by stablecoin issuers Tether and Circle. [The Crypto Times reports](https://www.cryptotimes.io/2026/11/07/binance-hackers-convert-124m-into-1650-bitcoin-as-3-1b-stays-in-linked-wallets/) that the attackers have converted $124 million into 1,650 bitcoin and that $3.1 billion remains in linked wallets.

Binance says it has replaced 90% of the stolen amount with company funds and will not pass losses to users. [TechCrunch reported](https://techcrunch.com/2026/11/07/binance-cfo-is-leaving-to-pursue-a-new-venture-after-6-3-billion-hack/) that its chief financial officer is leaving to "pursue a new venture."

## What this means

The theft shows where custody risk concentrates at the largest exchange: one compromised employee device could reach hot-wallet infrastructure, and Binance is now covering the loss from its own balance sheet. The exposure runs to Binance customers through counterparty risk and to BNB holders through the company's capital. It also extends to the stablecoin issuers, whose ability to freeze tokens did most of the recovery so far. Tether and Circle froze stablecoins, but the native assets the attackers took cannot be frozen. The extortion claim matters even if it is false. A real dataset of identity and address records would give criminals the information needed for the kidnapping and impersonation schemes that increasingly target wealthy holders. Extortionists benefit from being believed whether or not they hold anything. The closest precedent is the February 2025 Bybit theft by the same group. Most of the $1.5 billion was moved through cross-chain swaps within weeks and never recovered, and Bybit stayed solvent by borrowing to replace its reserves. The desk's read is that most of the unfrozen $3.1 billion will be converted to bitcoin and laundered through swaps and over-the-counter brokers over the coming weeks. That would leave the stablecoin freezes as the main source of recovery. That depends on withdrawals from Binance staying near normal levels. The read is wrong if authorities report large seizures of the non-stablecoin portion. On the data claim, there are two likely outcomes. Either the group publishes a verifiable sample and European data-protection regulators open cases, or no sample appears and the claim is never substantiated.

## What to watch

- Whether the extortion group publishes a verifiable sample of records. A real sample would bring in data-protection regulators and raise the physical-security risk for named users.
- Movement of the roughly $3.1 billion held in attacker-linked wallets. Steady conversion to bitcoin would follow the laundering pattern seen after the Bybit theft.
- Binance's next proof-of-reserves report and its withdrawal flows. They will show whether customers are taking money out after the theft and the executive departure.