Our Analysts Found the binance.com Combolist Circulating on Telegram

HEROIC analysts found a combolist labeled binance.com uploaded to Telegram on May 15, 2026. The file contains 116 records of email addresses paired with plaintext passwords and URLs, labeled by the uploader as credentials associated with Binance logins. This appears to be a targeted credential list rather than a breach of Binance's own systems. Why This Is Dangerous: Cryptocurrency accounts are a prime target because a successful login can mean direct access to funds. With 116 sets of plaintext credentials in circulation, anyone who obtains this file can attempt to log into each account without needing to crack a single password. What Was Exposed: The binance.com-labeled file contains three fields per record. - Email addresses - Plaintext passwords - URLs associated with the accounts Why This Matters: Even a small list like this one carries outsized risk because of what it targets. If an attacker successfully logs into a cryptocurrency account, withdrawals can happen fast and are often irreversible. And because people frequently reuse passwords across financial and email accounts, this leak can also feed credential stuffing attacks against other services, leading to account takeover or financial fraud well beyond the original 116 accounts. How a Combolist Like This Works: Credentials labeled with a specific platform name, like binance.com, are typically harvested through phishing pages that mimic the real login screen, or pulled from stealer malware that captured saved passwords on an infected device. They're then grouped by platform and sold or shared on Telegram because targeted lists are more valuable to attackers who specialize in a specific type of account. Check If You Are Affected: If you use Binance or any cryptocurrency exchange, it's worth checking your exposure now. HEROIC's free breach scanner searches your email against more than 400 billion breached records so you can act before an attacker does.