In 60 seconds: Binance, the world's largest crypto exchange, says about $6.3 billion was taken from its hot wallets on Thursday night in what would be the biggest crypto theft on record — and just hours earlier, prediction market Polymarket was hit by a separate breach that drained about $2.7 million from user accounts. Binance has frozen roughly $3 billion, pledged to cover all losses, and hopes to reopen withdrawals by Sunday.
- Binance puts the impact at about $6.3 billion; roughly $3 billion has been frozen with help from stablecoin issuers and other platforms.
- Withdrawals remain suspended while Binance rebuilds its systems; deposits are working again and a Sunday restart is the target.
- Investigators at TRM Labs attribute the attack to North Korea's TraderTraitor unit with "high confidence" — but there is no official attribution yet.
- Polymarket's breach was separate: a compromised third-party script drained an estimated $2.6–2.7 million before trading resumed.
- Binance.US and Polymarket US were not affected, and no source has linked the two incidents.
Honestly, the scale here is hard to overstate. The previous record crypto theft — the $1.5 billion Bybit hack in February 2025 — now looks small next to this. In about 20 minutes on Thursday evening, billions of dollars' worth of crypto left Binance's wallets, and the exchange spent the next hours confirming what on-chain watchers could already see.
Illustrative photo of Bitcoin. Photo: Wikimedia Commons (CC BY-SA 2.0)
What happened
At about 20:24 UTC on Thursday, October 29 — 4:24 p.m. Eastern — a single transaction moved 167,464 ether, roughly 1.6 billion USDT, and dozens of other tokens out of a hot wallet labeled Binance 14 to an outside address, according to on-chain trackers cited by CoinDesk and Blockhead. Within minutes, two more hot wallets were drained, and tracing firm TRM Labs later found the attacker withdrew most of the funds within about 20 minutes.
Binance first told TechCrunch it was dealing with a security incident and had suspended withdrawals on several networks as a precaution. Hours later it confirmed the worst: a major hack, all deposits and withdrawals suspended, and a promise to "cover all losses." By Friday morning its own estimate stood at about $6.3 billion in impacted assets, with about $3 billion frozen on-chain with partners. Co-CEO Richard Teng said Friday the investigation had found additional breach points beyond the first suspected cause, and that withdrawals could resume by Sunday, within roughly 40 hours.
Polymarket's incident came first. At about 2:05 p.m. Eastern on Thursday, its international platform went into cancel-only mode — users could cancel orders but not trade. The cause, the company said, was a compromised third-party provider. Reports identified the vector as a website-monitoring script from DebugBear that Polymarket's site loaded; security firm Hudson Rock found the injected code read login details, proxy wallet addresses, and trading API keys from browser storage. On-chain estimates put the damage at about $2.6–2.7 million across roughly 700 accounts. Trading resumed within hours, and Polymarket said affected users will be made whole.
Latest verified facts
Here's what is confirmed, and what is still only claimed. Binance's $6.3 billion figure is the company's own preliminary estimate, not an audited final loss — and frozen assets are not the same as recovered ones. The freezes include more than $1.567 billion in USDT frozen by Tether, more than $800 million in USDC frozen by Circle, about $200 million frozen by Ripple, and $27 million in World Liberty Financial's USD1 stablecoin. What cannot be frozen is the hard part: about 18,270 bitcoin, worth roughly $1.4 billion, was split into 19 wallets within minutes and had not moved as of early Friday, and about 204,500 ether taken represents roughly 5.6% of Binance's ether reserves.
On how it happened, Binance's preliminary account points to a compromised laptop belonging to a DevOps engineer, which gave the attacker access to a service container and let them submit unauthorized withdrawals. The exchange says it found no evidence of a wallet private-key leak. On Friday, Teng added that attackers used a self-destruct mechanism to erase evidence and exploited Ethereum's EIP-7702 account-delegation feature to take control of a hot wallet without going through normal approval procedures. That mechanism is Binance's account, not yet an independently confirmed forensic finding.
On who did it, be careful with the headlines. TRM Labs attributed the theft to TraderTraitor, a North Korean hacking unit, with "high confidence," and blockchain investigator ZachXBT said the attacker was "likely Lazarus." But Binance has not named an attacker, and no government has officially attributed this hack. Treat the North Korea link as a strong investigator lead, not a verdict. Binance says it has set aside more than $6.34 billion in company funds to cover the incident, and it plans an initial proof-of-reserves update before a full report on Monday. Its next regular reserve snapshot is due November 1, and that snapshot will show whether the hole in its ether backing has been filled.
Why it matters
This is not just a Binance story. The exchange is the world's largest, and its wallets are among those it uses to show customers their crypto is fully backed. When the biggest platform in the industry loses $6.3 billion in 20 minutes — through an employee laptop and a delegation feature most users have never heard of — it shakes confidence in every centralized exchange. CoinDesk reported Friday that institutional investors are already rushing to pull crypto off centralized exchanges.
It also exposes how crypto custody actually works. Hot wallets are online by design, so exchanges can process withdrawals quickly. That convenience is the vulnerability. And the Polymarket half of the story deserves its own attention: its smart contracts were never touched — the attack came through a third-party script on a website, the oldest trick in web security, applied to a platform where users keep real money in browser-connected wallets.
Impact on the USA and the world
For American users, the direct impact is limited in one important way: Binance.US and Polymarket US were reported unaffected. But the ripple effects cross borders fast. Bitcoin touched about $76,300 during the sell-off, and BNB, Binance's own token, closed Thursday down about 8%. If you hold crypto on any centralized exchange, the practical question this weekend is whether your platform keeps most assets in cold storage — offline — and whether it publishes proof of reserves you can actually check.
Globally, the incident hands regulators fresh ammunition. Every major exchange hack becomes Exhibit A in the argument for tighter custody rules, and this one — four times the size of Bybit — will be cited for years. It also lands days before the U.S. midterm elections, on platforms where Americans are betting real money on the outcome. Polymarket's own markets priced the hack in real time: its "total crypto hack value in 2026" market jumped past every threshold within an hour of the drain, before Binance had said a word.
What happens next
Watch three things. First, Sunday: does Binance actually reopen withdrawals on Teng's timeline, or does the rebuild slip? A delay would signal the damage to its systems runs deeper than the first statements suggested. Second, Monday's full report and the November 1 proof-of-reserves snapshot: those documents, not the X posts, will show how much of the $6.3 billion is truly gone versus frozen or recovered. Third, attribution: if the U.S. government formally names Lazarus or TraderTraitor, as it did after Bybit, this becomes a sanctions and diplomacy story as well as a markets one.
Our take: Binance's promise to cover all losses sounds reassuring, and its $6.34 billion reserve commitment is specific enough to check. But "user funds are safe" and "we will cover losses" are not the same as "your crypto is back in your wallet." Until withdrawals reopen and the reserves snapshot lands, treat every claim — including the $6.3 billion itself — as preliminary. The one thing already certain: Thursday, October 29, 2026 is now the day the largest crypto theft in history happened, and the industry's security story will be told as before and after it.
This is a developing story — updates to follow.
Sources: CoinDesk (October 30, 2026); Binance statements via X and co-CEO Richard Teng video statement (October 30, 2026); Reuters via timeline reporting (October 29–30, 2026); TRM Labs attribution via CoinDesk (October 30, 2026); Blockhead timeline (October 30, 2026); Polymarket status page and company statements (October 29, 2026); Bitquery and Bubblemaps estimates via trade-press reporting (October 30, 2026).
Related coverage: Prediction Markets Just Passed $1.4 Billion on the Midterms | Alphabet's $500 Billion Wipeout: Why AI Spending Fears Just Hit Wall Street