Binance Reports $6.3 Billion Hack as Polymarket Suffers Separate $2.7 Million Breach

Two of the best-known names in crypto suffered security breaches on the same day, 29 October 2026, in incidents that together shook digital asset markets and raised fresh questions about the safety of platforms that hold billions of dollars of customer money. Binance, the world’s largest crypto exchange, reported a security incident affecting roughly 6.3 billion dollars in crypto assets, after unauthorised withdrawals from hot wallets began at about 20:24 UTC. Separately, prediction market Polymarket suspended international trading after hackers drained user accounts in a breach estimated at about 2.7 million dollars. Business Insider reported there is no evidence the two incidents are related. They are two separate breaches on the same day, not an established coordinated attack — a distinction that matters, even if the coincidence invites speculation.

The Binance incident is, on the reported figures, the largest crypto hack in history. If the 6.3 billion dollar figure holds, it would surpass the previous record, the 1.5 billion dollar Bybit hack in February 2025, which was linked to North Korea, by a factor of more than four. But the figure itself is preliminary and contested, and the gap between different estimates is a story in itself. Independent blockchain tracing by TRM Labs put outflows at about 6.36 billion dollars across ten networks, while Chainalysis’ preliminary valuation cited by Cointelegraph was 5.912 billion dollars. The difference of nearly half a billion dollars reflects the difficulty of valuing fast-moving crypto assets in real time, distinguishing attacker withdrawals from legitimate movements, and accounting for funds frozen before they could be moved. The final unrecoverable loss is not yet settled, and readers should treat 6.3 billion dollars as an estimated impact, not a final audited customer-loss total.

How Binance says the breach happened

Binance said its preliminary investigation suggests a compromised laptop belonging to a DevOps engineer let an attacker reach a service container and submit unauthorised withdrawals. It said it found no evidence of a wallet private-key leak. That explanation, if correct, points to a familiar weakness in modern technology companies: the engineer who can deploy and manage systems is a high-value target, and compromising one person’s machine can open a path to infrastructure that holds enormous value. A service container is a standard unit of modern software deployment — a packaged piece of code that runs a particular service — and access to it can be enough to instruct withdrawals if the service is not properly isolated from the wallets it serves.

The explanation is, however, preliminary, not a completed forensic conclusion. Binance’s investigation is ongoing, and the history of major breaches shows that early explanations are often revised as investigators dig deeper. The absence of evidence of a private-key leak is reassuring in one respect — it suggests the attacker did not obtain the master keys that would allow unlimited theft — but it does not answer how a single compromised laptop could lead to withdrawals on this scale, what controls failed to stop it, or whether other systems were also accessed. Those answers will come from the full forensic report, if Binance publishes one, and from any law enforcement investigation that follows.

Binance’s response has been fast and, by the standards of crypto incidents, transparent about the scale. It paused deposits and withdrawals across multiple networks, which stops further outflows but also freezes legitimate users out of their funds for the duration. It said about 3 billion dollars had been frozen on-chain with help from partners. Tether said it froze more than 1.567 billion dollars in USDT linked to the incident, and Circle froze more than 800 million dollars; together, stablecoin issuers froze over 2 billion dollars. That freezing power — the ability of stablecoin issuers to blacklist addresses and render tokens unusable — is one of the most effective tools against crypto theft, and also one of the most controversial, because it shows that supposedly decentralised money can be stopped by central actors when they choose to act.

Binance hack user funds and the SAFU question

Binance said it will cover user losses from its Secure Asset Fund for Users, known as SAFU, and from company funds, and will publish an updated proof of reserves once remediation is complete. Binance.US was reported unaffected, which matters for American users who trade on the separately regulated American platform rather than the global exchange. The promise to cover losses is the most important statement Binance has made since the incident, because it determines whether customers will be made whole or will bear the loss of a breach they did not cause.

Whether that promise can be kept in full depends on numbers that are not yet public. Analysts note that SAFU holds about 1 billion dollars in Bitcoin by one estimate, so a gap could fall on the corporate balance sheet — but that is an estimate, not a company disclosure, and Binance’s total resources are far larger than SAFU alone. The company has not published a detailed accounting of how the loss will be covered, what proportion will come from SAFU versus company funds, or over what timescale users will be reimbursed. Until it does, the promise should be reported as a commitment, not as a completed reimbursement.

The market reaction was immediate and severe. The crypto market fell after the Binance news, with Bitcoin and Ether tumbling and more than 1 billion dollars in leveraged futures bets liquidated, according to CoinDesk. Leveraged bets are trades made with borrowed money, and when prices fall sharply, those bets are automatically closed — liquidated — which can accelerate the fall as selling begets selling. Standard Chartered, cited by CoinDesk, saw more pain ahead. That warning reflects a broader concern: a hack of this size does not only hurt the exchange’s customers, it damages confidence in the entire crypto ecosystem, and confidence is the main asset the ecosystem has.

Polymarket’s separate breach

Polymarket’s incident, while far smaller in dollar terms, is significant in its own right because of what Polymarket is: a prediction market where users bet on the outcomes of elections, sports, and other events, and which has become a closely watched indicator of public expectations, particularly around American politics. On 29 October, Polymarket suspended international trading after hackers drained user accounts. Polymarket said a third-party provider was compromised and it had referred the matter to law enforcement. A source told CNBC the provider was UK-based DebugBear, which confirmed a security incident. Polymarket itself did not confirm the totals reported by analysts to WIRED.

Blockchain analytics firm Bubblemaps estimated about 700 to 737 Polymarket users lost a combined 2.7 to 2.73 million dollars. That is a small fraction of the Binance figure, but for the individual users affected, the loss is real, and the fact that it came through a third-party provider raises a question that applies far beyond Polymarket: how much of a platform’s security depends on vendors it does not control? Modern web platforms rely on dozens of third-party services — for analytics, monitoring, customer support, payments — and a compromise of any one of them can become a compromise of the platform, if access is not properly limited.

Polymarket resumed trading after several hours, with trading resuming at 3 p.m. Eastern Time, and said users who lost under 10,000 dollars would be restored by 30 October, while larger losses require signing a release form. Polymarket US, the regulated platform, was not affected. The speed of the resumption and the tiered reimbursement plan suggest a company that had a response plan ready, or at least one that could be improvised quickly. The requirement that larger claimants sign a release form — effectively waiving further claims in exchange for reimbursement — is standard practice after a breach, but it also means that the largest victims must choose between a prompt partial recovery and preserving their right to pursue more.

Two breaches, one day, no established link

The coincidence of two breaches on the same day will inevitably fuel theories of a coordinated attack on crypto. On the current evidence, that theory is unsupported. The targets are different — a global exchange and a prediction market — the methods appear different — a compromised engineer laptop versus a compromised third-party provider — and the scales are orders of magnitude apart. Business Insider’s reporting that there is no evidence of a link is the responsible position until investigators say otherwise. Coincidences happen, particularly in an industry where many platforms share similar vulnerabilities and where attackers are constantly probing for weaknesses.

What the two incidents do share is a lesson about custody. Crypto platforms ask users to trust them with assets that, in the original vision of cryptocurrency, users would hold themselves. That trust is convenient — it makes trading easy — but it concentrates risk. When a platform holding billions is breached, the loss is correspondingly large. When a platform holding millions through a third-party integration is breached, the loss is smaller but the principle is the same: someone else held the keys, or the access, and that someone else was compromised. The incidents will renew the argument for self-custody — holding your own crypto in your own wallet — but self-custody has its own risks, and most users will continue to prefer the convenience of an exchange. The real question is whether exchanges and prediction markets can prove, through audits, insurance, and transparent incident response, that they deserve that trust. On 29 October, two of them failed that test on the same day.

No attacker has been publicly identified in either case. That is normal at this stage, and attribution in crypto hacks often takes months, if it comes at all. The more immediate questions are practical: will Binance make all users whole, and how quickly? Will Polymarket’s reimbursement plan satisfy its users? And will regulators — who have long warned about crypto security — use these incidents to push for stricter custody and cybersecurity requirements? The answers will shape not only the two companies involved, but the credibility of an industry that has now suffered its largest hack ever.

Sources

USN reviewed reporting from multiple outlets for this story. Read more from CoinDesk, Gazette Nigeria and Trade Brains.