TL;DR
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Blockchain investigators reported that about $6.36 billion moved from wallets associated with Binance on Oct. 29, in a possible record-setting cryptocurrency theft. Binance says the funds came from company-controlled holdings and that customer assets remain safe, but the attack method, responsibility and amount recoverable are still under investigation. Polymarket separately reported a breach with estimated losses of about $2.7 million.
Blockchain investigators reported that about $6.36 billion in cryptocurrency moved from wallets associated with Binance on Thursday, Oct. 29, in a possible record-setting theft from the world’s largest cryptocurrency exchange. Binance temporarily suspended deposits and withdrawals as it investigated the incident, and said the assets came from company-controlled holdings, not customer accounts; the full attack sequence and the amount ultimately recoverable remain unclear.
According to blockchain intelligence firm TRM Labs, the transfers spanned ten blockchains, with much of the activity taking place in about 20 minutes. The reported amount would exceed the approximately $1.5 billion Bybit theft in February 2025, which the source material describes as the prior record. These figures are reported estimates, and the investigation is ongoing.
Binance’s preliminary investigation indicated that attackers may have gained access through a compromised laptop belonging to a DevOps engineer. The attackers reportedly reached internal services that could submit withdrawal transactions the system treated as legitimate. Binance has identified other possible points of compromise and has not given a complete account of how the breach unfolded.
The exchange said it had enough corporate reserves and other resources to cover the reported loss, and said customer funds remained safe. The source material also reports that investigators and cryptocurrency issuers froze about $3 billion in assets. That does not establish how much will be returned: billions of dollars remain unrecovered, and Binance had not yet restored normal withdrawals in the account provided.
Security briefing · Reported Oct. 29
How Hackers Stole $6.3 Billion in Cryptocurrency in a Potentially Record-Breaking Heist
Blockchain investigators reported about $6.36 billion moving from Binance-linked wallets across ten blockchains. Binance says the assets were company-controlled and customer funds remain safe. The attack method, responsibility and recoverable amount are still under investigation.
01 / What is known
A massive reported movement, with key details unresolved
Binance temporarily suspended deposits and withdrawals as it investigated. The exchange said the assets came from company-controlled holdings rather than customer accounts and that it had enough reserves and other resources to cover the reported loss.
Ten networks, about 20 minutes
TRM Labs reported transfers across ten blockchains, with much of the activity taking place in roughly 20 minutes. The estimate may change as transactions are verified.
Funds said to be safe; access restricted
Binance said customer balances were not taken. Customers could still face limits on moving funds while deposits and withdrawals were restricted.
Frozen does not mean returned
Investigators and cryptocurrency issuers reportedly froze about $3 billion. The amount ultimately recovered, and the remaining loss, are not yet established.
An account balance can remain visible while a platform restricts withdrawals. Binance’s statement that it can cover losses is an assurance from the company; it does not establish that all reported funds have been recovered.
02 / The possible attack path
From employee device to withdrawal systems?
Binance’s preliminary investigation pointed to a possible compromised laptop belonging to a DevOps engineer. The complete sequence has not been confirmed, and the exchange has identified other possible points of compromise.
Possible device compromise
Investigators cited a laptop belonging to a DevOps engineer as one possible entry point.
Internal services reached
Attackers reportedly accessed services that could submit withdrawal transactions.
Transactions treated as legitimate
The system reportedly accepted submitted withdrawals as authorized. The technical cause remains unconfirmed.
Tracing and restrictions
Binance restricted deposits and withdrawals while investigators traced transfers and assessed recovery.
03 / Scale in perspective
Reported freeze compared with the transfer estimate
The figures below are reported estimates with very different certainty and scale. A freeze may limit losses, but it does not show what will be returned to the exchange.
Bar lengths use the $6.36 billion Binance transfer estimate as the reference. Polymarket’s separately reported incident is too small to appear at scale; its marker is enlarged for visibility.
04 / A separate platform breach
Polymarket reported a different security issue
The Polymarket incident is not reported as connected to the Binance event. It involved an outside software provider and affected users of the online prediction market.
More than 700 accounts
Investigators estimated that about $2.7 million was taken. Researchers said malicious code tied to the provider may have targeted logged-in users through active sessions, enabling unauthorized transactions.
- International trading and some transaction services were restricted.
- Some users reported losses in the hundreds of thousands of dollars.
Vulnerability addressed
Polymarket said it had addressed the vulnerability and would reimburse affected customers. The supplied reporting does not provide a reimbursement schedule or confirm that every loss has been verified.
- Final affected account count remains unconfirmed.
- Completion of reimbursements has not been established.
Market snapshot
Crypto prices at a glance
Reported prices and 24-hour changes from the supplied snapshot.
Live data sources listed in the supplied material: CoinGecko and alternative.me. Changes are over 24 hours.
05 / What investigators are watching
Attribution and recovery remain open
Both incidents show how platform access, custody and third-party software can put assets or user access at risk, even while the underlying blockchain networks continue operating.
Technical account
A fuller explanation of the breach, whether other systems were affected, and when normal deposits and withdrawals can resume.
Recovery totals
Updates on funds traced or frozen, how much is ultimately returned, and how any remaining loss is covered and documented.
Scope and reimbursement
Confirmation of affected accounts and whether promised reimbursements have been completed.
Key questions
What the reporting says—and what it does not
How much moved from Binance-linked wallets?
TRM Labs estimated about $6.36 billion across ten blockchains, with much of the activity in roughly 20 minutes. The estimate remains part of an ongoing investigation.
Were Binance customer funds reported stolen?
Binance said the assets came from company-controlled holdings and that customer funds remained safe. Customers nevertheless faced restrictions on deposits and withdrawals.
Who was responsible?
TRM Labs and Chainalysis attributed the attack to TraderTraitor, associated with North Korea in the supplied reporting. Binance had not formally confirmed the attribution.
How much has been recovered?
About $3 billion was reportedly frozen. The available information does not establish how much will ultimately be recovered or returned.
What happened at Polymarket?
Investigators estimated about $2.7 million was taken from more than 700 accounts in a separate incident involving an outside software provider. Polymarket said affected customers would be reimbursed.
What happens next?
Investigators will assess the attack path, trace assets and evaluate attribution. Service resumption and the final financial impact of both incidents remain uncertain.
Customer Access and Exchange Reserves
The reported scale makes the incident consequential even if customer account balances were not directly taken. While withdrawals are restricted, customers may be unable to access or move funds held on the exchange. That distinction matters: an account balance can remain visible while the customer cannot use the assets until the platform restores service.
The incident also points to a potential weakness in centralized exchange infrastructure, rather than a confirmed failure of the underlying blockchain networks. If attackers used an employee device or internal service to submit transactions, the event would show how access to a company’s systems can put assets under its control at risk. The precise technical cause has not been confirmed.
Binance’s assurance that it will cover losses is a company statement, not evidence that all funds have been recovered. The reported freeze of about $3 billion may limit losses, but the final recovery, customer impact and duration of service restrictions have not been established.
Products Worth Considering
Samsung 27 Odyssey OLED G5 (G50SF) QHD QD-OLED Gaming Monitor
Logitech MX Keys S Wireless Keyboard, Graphite
Amazon Kindle Paperwhite (12th Generation, 2024), 16 GB, 7-inch Display, Jade
As an affiliate, we earn on qualifying purchases.
A Separate Breach at Polymarket
Polymarket, an online prediction market, also restricted international trading and some transaction services on Thursday after investigating a separate security issue involving an outside software provider. The incidents are not reported as connected. Investigators estimated that about $2.7 million was taken from more than 700 accounts, while some users reported losses in the hundreds of thousands of dollars.
Researchers said malicious code tied to the provider may have targeted users who were already logged in, using active sessions to make unauthorized transactions. Polymarket said the vulnerability had been addressed and that affected customers would be reimbursed. The supplied material does not detail the reimbursement schedule or whether all losses have been verified.
Both incidents involve risks beyond the security of a blockchain itself: exchanges and online platforms rely on employees, internal services and outside software. The reported events underscore that platform access and custody arrangements can affect whether users can reach funds, even when the underlying networks continue operating.
Attribution and Recovery Still Open
The attack’s full path has not been established. Binance’s preliminary findings point to a possible compromised employee laptop and internal services, but the company has identified other potential points of compromise. It is not clear whether additional systems or assets were affected.
TRM Labs and Chainalysis attributed the Binance attack to TraderTraitor, a hacking operation associated with North Korea, according to the source material. Binance had not formally confirmed the attribution. The reported transfer total, the amount frozen and the final losses may also change as investigators trace assets and verify transactions.
It remains unclear when Binance will restore normal deposits and withdrawals, how much of the reported $6.36 billion can be recovered, and how the exchange will document coverage of any remaining loss. For Polymarket, the supplied information does not establish the final number of affected accounts or whether all reimbursements have been completed.
Investigations and Service Resumption
Binance said it was investigating how attackers gained access and whether other systems were compromised. The next concrete developments will be a fuller account of the breach, updates on the tracing or freezing of assets, and information about when deposits and withdrawals can resume. Until then, the exchange’s service status and recovery totals remain subject to change.
Investigators will also continue assessing the attribution claims and the reported movement of funds across blockchains. Polymarket’s next steps include confirming the scope of its incident and carrying out the promised reimbursements. Neither incident’s final financial impact is established by the information available here.
Key Questions
How much cryptocurrency was reportedly moved from Binance-linked wallets?
TRM Labs estimated about $6.36 billion moved across ten blockchains, with much of the activity occurring in roughly 20 minutes. The estimate is part of an ongoing investigation.
Were Binance customer funds reported stolen?
Binance said the assets came from company-controlled holdings rather than individual customer accounts and stated that customer funds remained safe. Customers nevertheless faced restricted deposits and withdrawals while the exchange investigated.
Who was responsible for the Binance attack?
TRM Labs and Chainalysis attributed the attack to TraderTraitor, which they associate with North Korea, according to the source material. Binance had not formally confirmed who was responsible.
How much was reportedly stolen from Polymarket?
Investigators estimated that about $2.7 million was taken from more than 700 accounts in a separate incident involving a third-party software provider. Polymarket said the vulnerability had been addressed and affected users would be reimbursed.
How much of the Binance funds have been recovered?
The source material reports that investigators and cryptocurrency issuers froze about $3 billion. It does not establish how much will ultimately be recovered or returned; billions were still described as unrecovered.
Source: Off Grid Survival
