# Binance hack ($6.3B) and Polymarket hack: what happened on 29 October 2026 and why money kept leaving By Pawnie (@pawnie_ on X). Web3. Published 2026-10-30. Canonical page: https://www.w3match.com/blog/binance-hack-polymarket-hack-october-2026 Timeline of the Binance hack ($6.3B) and the Polymarket hack ($2.65M) on 29 October 2026. Why withdrawals kept going, who is suspected, what is frozen and what to do now. In one evening, two platforms were hit three hours apart. Polymarket lost about $2.65M. Binance lost about $6.3B. Binance is now the largest crypto hack ever recorded. The question everyone asks is simple: if the world knew within an hour, why did money keep leaving? Here is what is confirmed, what is not, and what it means for your funds. Status as of the morning of 30 October 2026 (CET). The story is still moving. --- ## The 60-second version - **Polymarket:** about $2.65M drained from roughly 700 to 995 accounts (depends on the source). Cause: malicious JavaScript delivered through a third-party monitoring script. No smart contract bug. Refunds promised. - **Binance:** about $6.3B withdrawn from hot wallets on 10 blockchains in about 20 minutes. Binance points to a compromised DevOps engineer's laptop. About $3B is frozen. Binance says it will cover all losses. - **Suspects:** TRM Labs and Chainalysis point to TraderTraitor, a North Korea-linked group. No government has officially named anyone yet. - **Linked?** No evidence that Polymarket and Binance were hit by the same actor. There is an on-chain link between the Binance funds and the September Bitget hack. - **Binance status:** deposits work, withdrawals are paused, resumption expected within about 48 hours. ## Polymarket hack: a monitoring script turned into a drainer [Polymarket's international site](https://polymarket.com/?r=pawpawpawpaw) loaded a real user monitoring script from DebugBear, a UK company that measures page speed. That script was swapped for a wallet drainer. According to analysis by DefiPrime and Hudson Rock, the code read session data from the browser, found the order book client inside the page, and sold users' positions or moved their outcome tokens. For users logged in with email wallets, no signing prompt appeared. The proceeds were swapped to POL and sent to one address. Key numbers: - **Window:** about 17:10 to 18:03 UTC on 29 October - **Attacker address (Polygon):** `0x3F99139F1C5854bb628c2e576Aaf638e99dFfc18` - **Stolen:** 28.6M POL, about $2.65M - **Victims:** 700+ (Bubblemaps), about 710 (CNBC), 737 (Bitquery), about 995 (Conor Grogan). Polymarket has not published its own count. - **Largest single losses:** about $341K and $307K How Polymarket responded: cancel-only mode and relayer pause at 18:05 UTC, a fix, and trading back about an hour later. The company said a third-party provider was compromised, referred the case to law enforcement, and promised affected users would be made whole. Smart contracts were not touched. Polymarket US was not affected, according to CNBC. Two caveats matter for accuracy. → Polymarket did not name DebugBear. Reuters and CNBC did, citing a source. DebugBear itself confirmed a security incident on X and told customers to remove its code. → A trader who claimed an $800K loss was challenged by Bubblemaps, who said the drain did not match the pattern of other victims. Treat that claim as disputed. This is not Polymarket's first third-party incident this year. A malicious script from an undisclosed vendor hit users in June as well. ## Binance hack: 20 minutes, 10 networks, $6.3B The first drain started at 20:05 UTC (21:05 CET). TRM Labs tracked 233.46M XRP leaving first, then Solana, Optimism, Tron, Bitcoin and Ethereum. Most of the money moved within about 20 minutes. Binance's own estimate is about $6.3B. TRM puts it at about $6.36B at the prices of the moment. Chainalysis first said $5.9B, then about $6.4B. Different numbers, same order of magnitude. That is normal while prices swing and tracing continues. ### How it worked On Ethereum the attacker used EIP-7702, a feature that lets a normal wallet temporarily run smart contract code. One transaction carried 50 pre-signed authorizations for the Binance 14 hot wallet. One landed. Minutes later the wallet was swept: 167,464 ETH and 63 other tokens, including about $1.6B in USDT. On the other nine networks the attacker simply sent signed transfers. The important point: EIP-7702 was the tool, not the root cause. Analysts from TRM, SlowMist and Blockaid all describe a compromise of the signing infrastructure. In plain language, the attacker could get Binance's own system to approve withdrawals. Binance's preliminary finding, published around 02:25 UTC on 30 October: a compromised DevOps engineer's laptop gave access to a service container, which was used to submit unauthorized withdrawals. Binance says it found no evidence that private keys leaked. This is an early finding. A full post-mortem is promised. ### Who is behind it TRM Labs attributes the attack to TraderTraitor with high confidence, citing preparation patterns: small Tornado Cash withdrawals for gas on 28 October, tests and a dress rehearsal on 29 October. Chainalysis also points to TraderTraitor. ZachXBT says "likely Lazarus" and shows that funds from Binance and the September Bitget exploit were mixed at the same address after passing through THORChain. What is missing: any official attribution from a government agency. ## Why money kept leaving after everyone knew This is the question behind most searches. Four things happened at once. **1\. Binance paused withdrawals late and in steps.** First drain: 20:05 UTC. First official statement: 21:24 UTC. Withdrawals paused on part of the networks: 22:15 UTC. Full suspension of deposits and withdrawals: 00:04 to 00:13 UTC. For hours, normal users could still withdraw some assets on some networks. **2\. The hacked wallet kept receiving funds.** The EIP-7702 delegation on Binance 14 stayed active. Every new deposit routed to that wallet was swept by the attacker. TRM logged sweeps at 20:41, 20:59, 21:04, 21:44, 22:39 and 23:56 UTC. Analyst Wazz flagged live that a $200M USDT deposit had been swept within six blocks. The delegation was revoked only around 00:42 UTC. Of everything that night, this looks like the most costly operational gap. **3\. The attacker raced the freezes.** Tether froze the main wallet about 37 minutes after the big sweep. In that window the attacker sold about $325M in USDT to market makers through intent-based swaps at a premium above 10%, deposited USDT into Aave, sent funds to JustLend, split Bitcoin through a peel chain, and sold part of the RLUSD before Ripple froze the rest. **4\. Only some assets can be frozen.** Tether, Circle, Ripple and World Liberty can freeze their stablecoins. Nobody can freeze ETH, BTC, XRP or SOL. TRM says more than 420,000 ETH and 18,270 BTC, roughly $2.4B, remained with the attacker. Was there a customer bank run? Some institutional outflows were reported. Hard data on the size of customer withdrawals during the window does not exist yet in public sources. Treat "everyone ran for the exit" as unproven. ## What is frozen and who is covering the loss - **Frozen (Binance, verified):** about $3B, of which about $2.3B in USDT and USDC - **Tether:** about 1.77B USDT - **Circle:** about 825M USDC - **Ripple:** 40.5M RLUSD confirmed on-chain - **World Liberty Financial:** 27.8M USD1 - **Arbitrum Security Council:** about 8,425 ETH and 74.6M ARB Binance says it will cover all losses from the SAFU fund and company funds, and that user funds are safe. SAFU holds about 15,000 BTC, roughly $1.16B. That is a fraction of the loss, so most of the cover has to come from Binance's own balance sheet. The payout itself is a statement, not yet a confirmed transaction. DefiLlama data suggests Binance held about $144B in assets before the attack, so the theft is about 4%. Net of freezes, one DefiLlama contributor estimated the open gap near $1B. CZ said it may be slightly higher but will be covered. ## Are the Polymarket and Binance hacks connected? No evidence says so. - Different vectors: browser script vs. signing infrastructure - Different chains and assets: POL on Polygon vs. ETH, BTC and others on 10 networks - Different scale: roughly 2,400 times apart - No blockchain analytics firm has reported an on-chain link What the incidents share is a pattern, not an author. Polymarket, Predict.fun (about $400K, 27 October), Bitget (about $388M, September) and Binance all started with a trusted middle layer: a vendor script, a documentation page, a security product, an employee laptop. Not a smart contract bug. ## Other exchanges: confirmed vs. rumor Rumors spread fast that night. Here is the sorted list. - **Confirmed:** Predict.fun, about $400K USDT, 27 October, third-party documentation page, refunds promised - **Confirmed, earlier:** Bitget, about $388M, 24 September, linked on-chain to the Binance funds by ZachXBT - **False:** Bybit hacked at the same time. Bybit said it was not affected and withdrawals stayed open - **Not affected per official statements:** Coinbase, KuCoin, Binance.US - **No credible reports:** OKX, Kraken - **Not a new hack:** Ledger. A supply-chain issue through a reseller is real and dates from early October. It is not the Binance event - **Unverified speculation:** "AI agents did it" and "one actor behind everything" - **Spam and phishing:** fake refund forms, "support" DMs, "claim your compensation" links. Ignore them all ## What happened to the market - **BTC:** from about $80.3K to under $77K - **BNB:** from $738.90 to $692.32 in minutes, no BNB was stolen - **Liquidations:** about $1.53B in 24 hours, mostly longs - **Fear & Greed:** from 51 to 30 - **Winners:** HYPE and TRX rose. Markets rewarded non-exchange alternatives The reaction was milder than the size of the theft suggests. The market bet on Binance covering the loss. Next tests: withdrawals reopening on schedule and a fresh Proof of Reserves. ## Is Binance safe? What to do now Nobody can promise anything, but here is a practical checklist. → Do not trust DMs, "refund" links or "compensation" forms. Use official channels only. → Do not sign anything you did not start yourself. That includes batch transfers and EIP-7702 authorizations. → If you use [Polymarket](https://polymarket.com/?r=pawpawpawpaw), close old tabs and reload. Move larger balances to a wallet that asks for manual confirmation, ideally hardware. → Spread your risk across venues. One exchange, one point of failure. → Avoid leverage during incidents. About $628M was liquidated in the first hour. That loss came from leverage, not from the hack. → Builders: isolate third-party scripts, monitor EIP-7702 delegations on treasury wallets, and rehearse delegation revocation. ## FAQ **Was Binance hacked?** Yes. Binance and CZ confirmed it. Estimated impact: about $6.3B. **How much was stolen from Binance?** About $6.3B by Binance's estimate. TRM says $6.36B at the time of theft. Chainalysis cites up to $6.4B. **Is my money on Binance safe?** Binance says user funds are safe and that it will cover all losses. That is a company statement. Watch for the post-mortem, the new Proof of Reserves and the actual withdrawal restart. **When will Binance withdrawals resume?** Binance expects within about 48 hours of the 30 October update. Deposits already work. No exact time has been given. **Who hacked Binance?** TRM Labs and Chainalysis point to TraderTraitor, a North Korea-linked group. ZachXBT says likely Lazarus. No government attribution yet. **Was the Binance hack bigger than Bybit?** Yes. TRM calls it the largest crypto theft in history, about four times the 2025 Bybit hack. **What is SAFU?** Binance's emergency insurance fund. It holds about 15,000 BTC, around $1.16B, not enough to cover the loss alone. **Was Polymarket hacked?** Yes, its international site, through a compromised third-party monitoring script. About $2.65M, no smart contract bug. **Will Polymarket refund users?** It promised full refunds. Reports say losses under $10,000 are to be returned by 30 October, and larger claims require signing a release form. Payouts are not yet independently confirmed. **Was Bybit, Coinbase, OKX or Kraken hacked too?** No credible evidence. Bybit and Coinbase said they were not affected. --- **Sources:** Binance and CZ on X · TRM Labs · Chainalysis · ZachXBT · WazzCrypto · Bubblemaps · DefiPrime · Hudson Rock · CoinDesk · Cointelegraph · Bloomberg · Reuters · CNBC · Axios · Bleeping Computer · The Block · DefiLlama. _Information as of the morning of 30 October 2026 (CET). The investigation is ongoing and figures may change. This article describes events and is not financial or legal advice._ _Referral disclosure: the Polymarket links in this article are referral links. W3Match may receive a reward if you sign up through them. This is not a recommendation to trade, and availability depends on your country, so check Polymarket's terms first._