October 29, 2026 turned out to be to crypto what the same day was to stocks: first the Nasdaq fell 1.4% on Alphabet, Amazon and Intel earnings, then, after the US close, billions left Binance's hot wallets. The exchange put the damage at $6.3 billion, the largest theft in the industry's history. The previous record, the $1.5 billion Bybit hack of February 2025, was beaten more than four times over.
That same Thursday, Polymarket users lost about $2.65 million. Two attacks, two different entry points: at Binance an engineer's laptop and the signing infrastructure, at Polymarket a third-party vendor's script. The common thread: the perimeter ran not through smart contracts but through people and vendors.
Fig. 1. The largest crypto thefts, $ million. Source: Binance, TRM Labs, media.
Co-CEO Richard Teng added that this was not a single "one-click" action and not the misuse of one employee's permissions, but a more complex process; the investigation has not attributed responsibility to any individual. A technical post-mortem is promised once the facts are verified.
The exchange suspended deposits and withdrawals, revoked the affected address authorisation and pledged to cover all losses from its SAFU fund and company funds. About $3 billion was frozen on-chain: Tether blocked $1.57 billion in USDT, Circle about $0.8 billion in USDC, and Arbitrum $30.5 million.
The mechanics are unusual for crypto. The attacker did not crack keys but exploited EIP-7702, the Ethereum standard that lets an ordinary wallet delegate execution to a smart contract. Blockaid estimates he submitted 50 authorisations in a row to hit the live nonce, and one landed. Wallet Binance 14 then sent 167,464 ETH and 63 tokens, including $1.6 billion in USDT, another 28,005 ETH came from Binance 16, and a bitcoin wallet gave up 18,270 BTC. No keys formally leaked, yet the signatures were genuine: Binance's own infrastructure signed them while under the attacker's control.
By The Hacker News tally, the attackers still hold more than 420,000 ETH and 18,270 BTC worth about $2.4 billion. The rest sits in stablecoins that issuers can freeze, which is why Binance's recovery share is higher than Bybit's a year earlier.
Fig. 2. Binance damage: frozen versus still with attackers, $ billion. Source: Binance, TRM Labs.
Estimates climbed in public: $2 billion, $3.5 billion, $5.6 billion, $6.3 billion. Some outlets initially reported a private key leak; Binance denies it. Some analysts call it theft, others misuse of signatures, since legally the exchange itself authorised the transfers. A separate line is an insider: it is neither confirmed nor ruled out, and Binance stresses that one engineer's permissions were not the issue. Another rumour holds that one group is behind both Binance and Polymarket. There is no evidence: the attacks used different paths, and no link has been established.
But there is no formal accusation: Binance has not named a culprit and US authorities have not attributed the attack. Counterarguments exist. North Korean crews usually move and launder funds faster than the attacker did on Thursday. And in the Bitget case, CEO Gracy Chen did not rule out an insider. So the North Korea version is the strongest, but not yet proven.
Arkham and Bubblemaps estimate that about 700 accounts were hit and roughly $2.65 million was taken. Trading resumed about an hour later and the platform promised full reimbursement; users' seed phrases were not affected. It is Polymarket's second incident this year: in May an internal admin wallet was compromised for $700,000.
That same Thursday, Polymarket users lost about $2.65 million. Two attacks, two different entry points: at Binance an engineer's laptop and the signing infrastructure, at Polymarket a third-party vendor's script. The common thread: the perimeter ran not through smart contracts but through people and vendors.
Fig. 1. The largest crypto thefts, $ million. Source: Binance, TRM Labs, media.
The engineer's laptop
Binance's official account appeared overnight on October 30. "Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions," the exchange said. It found no evidence of a wallet private key leak.Co-CEO Richard Teng added that this was not a single "one-click" action and not the misuse of one employee's permissions, but a more complex process; the investigation has not attributed responsibility to any individual. A technical post-mortem is promised once the facts are verified.
The exchange suspended deposits and withdrawals, revoked the affected address authorisation and pledged to cover all losses from its SAFU fund and company funds. About $3 billion was frozen on-chain: Tether blocked $1.57 billion in USDT, Circle about $0.8 billion in USDC, and Arbitrum $30.5 million.
Twenty minutes and ten chains
According to TRM Labs, about $6.36 billion left Binance wallets across ten blockchains. Bitquery counted 17 hot wallets and nine networks: most of the money went in roughly 20 minutes, but the attacker kept sweeping new deposits for almost four hours.The mechanics are unusual for crypto. The attacker did not crack keys but exploited EIP-7702, the Ethereum standard that lets an ordinary wallet delegate execution to a smart contract. Blockaid estimates he submitted 50 authorisations in a row to hit the live nonce, and one landed. Wallet Binance 14 then sent 167,464 ETH and 63 tokens, including $1.6 billion in USDT, another 28,005 ETH came from Binance 16, and a bitcoin wallet gave up 18,270 BTC. No keys formally leaked, yet the signatures were genuine: Binance's own infrastructure signed them while under the attacker's control.
By The Hacker News tally, the attackers still hold more than 420,000 ETH and 18,270 BTC worth about $2.4 billion. The rest sits in stablecoins that issuers can freeze, which is why Binance's recovery share is higher than Bybit's a year earlier.
Fig. 2. Binance damage: frozen versus still with attackers, $ billion. Source: Binance, TRM Labs.
Rumours: from "routine maintenance" to an insider
The first hours produced the usual spread of theories. At 20:24 UTC, as 167,000 ETH left Binance 14, researcher Spreek suggested: "It could be routine wallet maintenance, but it looks extremely sus." The theory did not last: the recipient was a brand-new address and the funds moved on immediately.Estimates climbed in public: $2 billion, $3.5 billion, $5.6 billion, $6.3 billion. Some outlets initially reported a private key leak; Binance denies it. Some analysts call it theft, others misuse of signatures, since legally the exchange itself authorised the transfers. A separate line is an insider: it is neither confirmed nor ruled out, and Binance stresses that one engineer's permissions were not the issue. Another rumour holds that one group is behind both Binance and Polymarket. There is no evidence: the attacks used different paths, and no link has been established.
Why North Korea is blamed
TRM Labs said with "high confidence" that the attack was carried out by TraderTraitor, a unit of the North Korean Lazarus group. Chainalysis reached the same conclusion after finding that the $388 million stolen from Bitget in September was commingled with Binance funds. ZachXBT and Check Point also point to Lazarus, and analysts note that the same group stood behind Bybit in 2025.But there is no formal accusation: Binance has not named a culprit and US authorities have not attributed the attack. Counterarguments exist. North Korean crews usually move and launder funds faster than the attacker did on Thursday. And in the Bitget case, CEO Gracy Chen did not rule out an insider. So the North Korea version is the strongest, but not yet proven.
Polymarket: same day, another front
Polymarket lost far less but demonstrated a nastier class of vulnerability. At about 2:33 p.m. New York time it halted trading: one of its third-party providers, UK-based DebugBear according to CNBC, had been compromised. In a script it served on polymarket.com, Hudson Rock found code that looked for an active trading session and drained funds.Arkham and Bubblemaps estimate that about 700 accounts were hit and roughly $2.65 million was taken. Trading resumed about an hour later and the platform promised full reimbursement; users' seed phrases were not affected. It is Polymarket's second incident this year: in May an internal admin wallet was compromised for $700,000.
⚠ IMPORTANT
Two attacks in one day showed where the defence line actually runs. Not through smart contracts or cold storage, but through an engineer's laptop and a vendor's script. Three billion dollars were frozen and $3.3 billion were not; bitcoin fell to $76,368, ether to $2,178, and liquidations topped $1.5 billion. While the investigation continues, one conclusion holds: "not your keys, not your coins" now cuts both ways. Even someone else's keys do not help when the signing infrastructure is run by the attacker.