TL;DR
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Blockchain investigators reported that about $6.36 billion in cryptocurrency moved from wallets associated with Binance on Thursday, October 29, potentially making it the largest cryptocurrency theft on record. Binance says the funds came from company-controlled holdings and that customers’ funds are safe, but the exchange has not confirmed the full attack sequence or who was responsible. Polymarket separately restricted trading after a reported breach affecting more than 700 accounts.
Blockchain investigators reported that about $6.36 billion in cryptocurrency moved from wallets associated with Binance on Thursday night, October 29, in a suspected attack that could surpass the previous reported record for a cryptocurrency theft. Binance suspended deposits and withdrawals while investigating; the company says the assets belonged to its corporate holdings, not individual customers, and that customer funds remain safe.
Blockchain intelligence firm TRM Labs said the transfers crossed 10 blockchains, with much of the activity occurring in about 20 minutes. The reported total is far above the approximately $1.5 billion stolen in the February 2025 Bybit breach, which the source material identifies as the prior record. The scale and classification of the Binance incident remain subject to the ongoing investigation.
Binance’s preliminary account points to a possible compromised laptop belonging to a DevOps engineer. Investigators suspect the access may have let attackers reach internal services and submit withdrawal transactions the systems treated as legitimate. Binance has identified other possible points of compromise and cautioned that it has not established the complete sequence of events.
Binance says it will cover the losses from corporate reserves and other available resources. The source material says cryptocurrency issuers and investigators have reportedly frozen about $3 billion of the assets, but that figure and the amount ultimately recovered remain unconfirmed in the available details. Binance suspended deposits and withdrawals during its investigation, leaving users unable to access those services while the company works to restore normal operations.
Inside the Hackers’ $6.3 Billion Cryptocurrency Heist: A Potential Record
Blockchain investigators reported roughly $6.36 billion in transfers from Binance-linked wallets. The exchange says the assets came from corporate holdings and customers’ funds are safe, while the incident and its cause remain under investigation.
What investigators say happened
TRM Labs reported that much of the Binance-linked activity unfolded in about 20 minutes. The reported total exceeds the approximately $1.5 billion Bybit breach in February 2025, identified in the source material as the prior record.
Corporate holdings
Binance says the transferred assets belonged to company-controlled holdings, not individual customers. The exchange says it will cover losses from corporate reserves and other available resources.
Internal access under review
Binance’s preliminary account points to a possible compromised laptop belonging to a DevOps engineer. Investigators suspect access may have enabled withdrawal requests that internal systems treated as legitimate.
Sequence and recovery
Binance has identified other possible compromise points and has not established the full sequence. The reported freeze of about $3 billion does not establish how much will ultimately be recovered.
Transfers detected
Investigators report movement across 10 blockchains.
Services paused
Binance suspended deposits and withdrawals during its investigation.
Assets traced
Investigators reportedly froze around $3 billion; the figure remains unconfirmed.
Investigation continues
Entry point, attribution, recovery, and service timeline remain open questions.
Crypto market snapshot
Values reproduced from the supplied report. Market prices are a snapshot and do not establish a connection to either security incident.
Fear & Greed Index
Market sentiment indicator cited in the source material.
Live data cited · CoinGecko · alternative.me · 24-hour change
Two platforms, separate breaches
The reported Polymarket incident involved an outside software provider and affected accounts. It is separate from the Binance investigation.
Trading restricted
Polymarket temporarily restricted international trading and suspended some transaction services after reports of unauthorized transactions and missing funds.
About $2.7 million
Researchers reportedly estimated that roughly $2.7 million was taken from more than 700 accounts. These remain reported estimates.
Vulnerability addressed
Polymarket said the vulnerability had been addressed and affected customers would be reimbursed. The source material does not confirm how many reimbursements are complete.
“Approximately $6.36 billion was moved across 10 different blockchains.”TRM Labs
The cost of a centralized breach
A platform-level security failure can interrupt access to funds even when customer balances are not reported stolen. Suspended withdrawals can leave customers unable to move or use assets while a platform responds.
That disruption is distinct from a confirmed loss of customer deposits; Binance says its customers’ funds are safe. The suspected route also focuses attention on internal systems, privileged access, and third-party software. It does not indicate a reported failure in the underlying blockchain networks.
Restricting services can limit further unauthorized activity, but can also leave users waiting for access or reimbursement. These incidents show potential consequences of platform breaches; they do not establish that digital financial services as a whole are unsafe.
Key forensic questions remain
Outside investigator assessments and preliminary company statements are not the same as a confirmed finding.
How did access begin?
It is unclear how the suspected laptop compromise occurred, which internal services may have been accessed, or whether other systems were affected.
Who was responsible?
TRM Labs and Chainalysis reportedly linked the activity to TraderTraitor, an operation associated with North Korea. Binance has not formally confirmed that attribution.
What is the final toll?
Losses and affected account counts are estimates. The source material does not establish reimbursement progress, exposure duration, or whether additional accounts were affected.
How much was reportedly moved from Binance-linked wallets?
About $6.36 billion, according to TRM Labs, across 10 blockchains. The incident remains under investigation.
Did Binance say customer funds were stolen?
No. Binance said the assets came from corporate holdings and that customer funds are safe. The source material does not provide independent confirmation of that assurance.
How much will be recovered?
Unknown. About $3 billion was reportedly frozen, but the figure and ultimate recovery remain unconfirmed.
When will services return to normal?
No timeline is provided. Updates should clarify when Binance deposits and withdrawals resume and how frozen assets are handled.
Recovery and service updates
Future disclosures can help distinguish preliminary reporting from confirmed findings.
Service status
Whether Binance deposits and withdrawals have resumed, and when.
Recovery accounting
How reported frozen assets are handled and what amount returns.
Forensic findings
The entry point, internal access, and any confirmed attribution.
Polymarket remediation
Containment confirmation, completed reimbursements, and provider details.
No timeline for Binance service restoration or recovery is available in the source material. Investigators’ assessments should be distinguished from conclusions formally confirmed by Binance or law enforcement.
The Cost of a Centralized Breach
The reported transfers highlight how a security failure at a centralized exchange can affect access to funds even when customers’ account balances are not reported stolen. If withdrawals are suspended, customers may be unable to move or use assets while the platform responds. That access disruption is distinct from a confirmed loss of customer deposits, and Binance says its customers’ funds are safe.
The suspected route also points to the risks of internal systems and third-party access, rather than a reported failure in the underlying blockchain networks. If investigators confirm that an employee device or internal service provided the entry point, the incident could raise questions about how exchanges secure privileged access and validate withdrawal requests. At this stage, the evidence described is preliminary, and the precise vulnerability has not been established.
The separate Polymarket incident shows that risks can extend beyond exchanges to platforms that rely on outside software. In both cases, the reported response included restricting services while investigating. That can limit further unauthorized activity, but it can also leave users waiting for access or reimbursement. The events do not establish that digital financial services as a whole are unsafe; they do show the consequences a platform-level breach may have for customers.
Products Worth Considering
Apple MacBook Pro 14-inch Laptop with M5 Pro chip, 18-core CPU, 20-core GPU, 24GB Unified Memory, 2TB SSD, Wi‑Fi 7 – Space Black
Apple MacBook Pro with M5 Max 18-core CPU 20-core GPU 14.2-inch Display 48GB Memory 2TB SSD Space Black
Apple MacBook Pro 16-inch (2021) with M1 Max, 64 GB RAM, 2 TB SSD – Space Grey
As an affiliate, we earn on qualifying purchases.
Two Platforms, Separate Breaches
The Binance incident was not the only reported security event on Thursday. Polymarket, an online prediction market, temporarily restricted international trading and suspended some transaction services after users reported unauthorized transactions and missing funds. The company described the matter as a security issue involving an outside software provider, according to the source material.
Researchers reportedly said malicious code tied to the compromised provider may have targeted users who were already logged in, using active sessions to initiate transactions rather than stealing passwords one by one. Investigators estimated that about $2.7 million was taken from more than 700 accounts. Polymarket said the vulnerability had been addressed and affected customers would be reimbursed. The source material also says the platform had faced earlier incidents involving compromised software or outside providers, but supplies no dates or further details.
For Binance, blockchain firms TRM Labs and Chainalysis attributed the attack to TraderTraitor, a hacking operation associated with North Korea. Binance has not formally confirmed the attribution. The firms’ assessment is a claim by outside investigators, not an established finding about who carried out the attack.
“Approximately $6.36 billion was moved across 10 different blockchains.”
— TRM Labs
Key Forensic Questions Remain
The full path of the Binance attack remains under investigation. It is not clear how the suspected laptop compromise occurred, which internal services may have been accessed, or whether additional systems were affected. The total that can be recovered is also unknown; the reported freeze of about $3 billion does not establish how much will return to Binance.
Responsibility has not been confirmed. TRM Labs and Chainalysis reportedly linked the activity to TraderTraitor, but Binance has not publicly confirmed that attribution. The source material also does not provide independent confirmation of the exchange’s assurance that all customer funds remain safe or details of when deposits and withdrawals will fully resume.
For Polymarket, the reported losses and number of affected accounts are estimates, and the material does not say how many customers have received reimbursement. The exact method used to exploit the outside provider, the duration of the exposure, and whether further accounts were affected remain unclear.
Recovery and Service Updates
Binance is continuing its forensic investigation and will need to clarify the suspected entry point, the reach of any internal access, and the status of affected services. The next public updates should establish whether withdrawals have resumed, how the reported frozen assets are being handled, and whether the exchange can support its pledge to cover the losses. No timeline for those steps is provided in the source material.
Investigators and blockchain firms may also provide updates on attribution and recovery, but those findings should be distinguished from conclusions formally confirmed by Binance or law enforcement. For Polymarket, relevant developments include confirmation that the vulnerability is contained, the completion of customer reimbursements, and any further information about the third-party software involved. Until those details are available, the scale and effects of both incidents remain developing.
Key Questions
How much was reportedly moved from Binance-linked wallets?
TRM Labs estimated about $6.36 billion moved across 10 blockchains. The figure is based on reported blockchain transfers and the incident remains under investigation.
Did Binance say customer funds were stolen?
No. Binance said the reported assets came from company-controlled holdings and that customer funds remain safe. The company’s investigation is ongoing, and its assessment has not been independently confirmed in the source material.
Who do investigators suspect was behind the Binance incident?
TRM Labs and Chainalysis reportedly attributed the activity to TraderTraitor, a group associated with North Korea. Binance has not formally confirmed who was responsible.
What happened at Polymarket?
Polymarket temporarily restricted international trading and some transaction services after a reported breach involving an outside software provider. Investigators estimated about $2.7 million was taken from more than 700 accounts; the company said it addressed the vulnerability and would reimburse affected customers.
Is the reported Binance theft the largest cryptocurrency theft on record?
It could be, based on the reported $6.36 billion figure. The source material compares it with the approximately $1.5 billion Bybit breach in February 2025, but Binance’s incident is still under investigation and its final loss and recovery figures are not settled.
Source: Off Grid Survival
