Binance estimates a $6.3 billion impact; frozen assets are not completed recoveries. Polymarket restored service after a third-party compromise; forensic estimates remain provisional. Verify
Developing report | Reporting checked October 30, 2026, 2:46 a.m. Eastern (GMT−04:00). Event times below are Eastern (GMT−04:00).
Binance and Polymarket disclosed separate security incidents on October 29. Binance estimates a multibillion-dollar impact and continues to restrict withdrawals. Polymarket says it fixed a compromise involving an outside provider and has restored trading. The available evidence does not establish a connection between the two incidents.
The immediate questions are different for each platform: what funds moved, which services remain restricted, and how promised compensation will work. A company assurance, an on-chain transfer and a completed reimbursement are three different kinds of evidence.
In its official incident statement, Binance put the estimated impact at approximately $6.3 billion and said about $3 billion had been frozen on-chain with partners. It pledged to cover losses using its SAFU fund and company resources, and to publish a technical post-mortem and updated proof of reserves after remediation.
Those are company statements, not independent confirmation that affected customers have already been compensated. Frozen assets are not necessarily recovered or returned; subtracting the frozen amount from the impact estimate would not produce an audited net loss.
Binance's preliminary account points to a compromised DevOps engineer's laptop, access to a service container and unauthorized withdrawal requests. It said it had found no evidence of a wallet-private-key leak. The root cause remains under investigation.
A newer update from the verified Binance News account says deposits are operating normally while withdrawals remain paused during a security overhaul. Binance expects withdrawals to resume within 48 hours; that is an estimate, not a guaranteed reopening time. Earlier restrictions should not be mistaken for the latest status, or described as a blanket trading halt.
TRM Labs' investigation estimates approximately $6.36 billion moved from Binance-attributed wallets across ten blockchains, valued at transfer-time prices. Its snapshot ends at 8:30 p.m. on October 29. TRM says most funds moved within roughly 20 minutes starting around 4:05 p.m.
TRM describes an Ethereum EIP-7702 authorization that delegated a hot wallet's behavior to malicious code, alongside ordinary signed transfers on other chains. Its assessment is that the signing infrastructure was compromised. A valid blockchain signature demonstrates acceptance by the network; it does not, by itself, reveal who requested it or prove that a private key was stolen.
TRM attributes the attack to the North Korea-linked TraderTraitor group with high confidence. That remains TRM's attribution, not a finding independently established by CoinRank. Its $6.36 billion outflow estimate is not additional to Binance's $6.3 billion figure. Different timestamps, prices and asset coverage can produce different totals.
Polymarket's official incident record shows its international platform entered cancel-only mode and paused its transaction relayer at 2:05 p.m. on October 29. At 2:37 p.m., it said an outside provider had been compromised, the issue had been fixed, law enforcement had been contacted and affected users would be made whole. The status page marked the incident resolved at 3:05 p.m.
That record concerns Polymarket.com; it should not be presented as evidence of a breach at Polymarket US. Nor does a restored service status establish that every affected balance has been reimbursed.
Hudson Rock's technical investigation found wallet-draining functionality in a third-party script associated with the site. Its analysis describes attempts to access trading functions, sell positions and move assets. Static code analysis establishes what code attempts to do, not that every operation succeeded. The researchers explicitly distinguish wallet-balance snapshots from a verified total loss.
Bitquery's investigation estimates $2.73 million left 737 accounts between 1:10 and 2:10 p.m. on October 29. It traced transfers into a specified receiving address and subsequent movements on Polygon and Ethereum, with coverage ending at 3:49 p.m. Wallets or accounts are not necessarily separate people.
Its dollar methodology treats pUSD, USDC and USDC.e as $1 and uses a specified price snapshot for POL and ETH. Other receiving routes are excluded, and outcome shares are not dollar-valued. This is a scoped research estimate, not a final platform-wide loss total.
Bitquery also reports a further approximately $10.99 transfer at 3:11 p.m.—after the official status page marked the incident resolved. That observation merits clarification, but does not prove that an exploit remains active now.
The researchers list this Polygon transaction among their evidence. CoinRank reviewed the published methodology but could not independently retrieve the explorer receipt during preparation. The transaction-level claims above are therefore attributed to Bitquery, not presented as our own reconstruction.
The useful next evidence is operational, not another larger headline number: Binance's withdrawal reopening and technical post-mortem; both platforms' compensation procedures and completed payments; and updated forensic reports that reconcile transfers, freezes, returns and valuation times.
For users, a functioning website is not the same as a completed security investigation. For analysts, multiple hops of the same assets should not be added together as fresh losses. Neither the companies' reimbursement promises nor an investigator's wallet labels should be treated as guarantees.
The FBI warns that cryptocurrency-recovery fraudsters approach victims through social media, impersonate recovery professionals and request fees without recovering funds. Treat unsolicited refund or support messages as unverified.
Prepared with AI assistance and editorial source checking. This is a developing report; company statements and third-party forensic assessments are identified separately.
〈Binance and Polymarket Security Incidents: What Is Confirmed and What the Chain Shows〉這篇文章最早發佈於《CoinRank》。
