#cryptotheft

Read Time:3 Minute, 36 Second

The World’s Largest Exchange Hits the BrakesBinance, the largest cryptocurrency exchange by trading volume, has suspended all deposits and withdrawals while it investigates what could turn out to be the biggest crypto theft ever recorded. The exchange first acknowledged a security incident on October 30, 2026, and has since raised its own estimate of the potential impact to $6.3 billion, with roughly $3 billion of that figure already frozen on-chain through cooperation with blockchain partners.

In a public statement, Binance told users that “user funds are safe” and promised to personally cover any losses once the investigation concludes, while declining to specify an entry point, name a suspect, or offer a timeline for reopening withdrawals.

A Moving Target: Estimates Have Swung WildlyFew numbers in this story have stayed still for long. Early reporting linked suspicious transfers to large outflows across Ethereum, Bitcoin, and TRON, with figures cited around $1.45 billion in Bitcoin and $875 million in Ether alongside various stablecoins. Other outlets placed the range anywhere between $1.7 billion and $5.7 billion as analysts worked to separate confirmed attacker-controlled wallets from ordinary exchange activity that simply looked unusual in the moment.

That gap matters because a large transfer out of an exchange wallet is not, on its own, proof of theft — investigators still need to trace which receiving addresses are actually connected to the same attacker before a number can be called reliable. Binance’s own updated estimate of $6.3 billion is the exchange’s internal figure rather than an independently audited total, and the company has stressed that tracing efforts are still underway.

Stablecoin Issuers Move Fast to Freeze FundsWithin hours, the companies behind major stablecoins began locking down wallets tied to the suspected attack. Tether reportedly froze close to $1.57 billion, Circle froze more than $800 million, and Binance co-founder Yi He said Ripple had frozen roughly $200 million more — together accounting for close to $2.4 billion in blocked stablecoin funds. Binance separately reported $2.54 billion in verified frozen assets as tracing continued.

It’s worth being precise about what “frozen” means here: these actions stop the funds from moving further, but they do not automatically return money to Binance or its users. Recovery, if it happens, is a distinct and typically much slower legal and technical process.

A DevOps Laptop in the CrosshairsIn its most recent update, Binance said its preliminary investigation points toward a compromised laptop belonging to a DevOps engineer as the likely entry point, suggesting an attacker may have used that access to reach a service container and push through unauthorized withdrawal transactions. Importantly, Binance says it has found no evidence that wallet private keys themselves were leaked — which, if it holds up, would be a meaningfully less catastrophic root cause than a direct key compromise, though the exchange has emphasized that the investigation is still active and the picture could change.

This wouldn’t be the first time an exchange breach traced back to compromised infrastructure rather than a stolen key outright. Earlier incidents in the industry, including the widely analyzed Bybit breach, have shown attackers manipulating transaction data during what looked like a routine transfer after compromising a wallet provider’s environment — a useful point of comparison, though nothing currently ties that earlier case to this one.

What Happens NextBinance has said it will publish a full post-mortem once its internal review wraps up. Until then, the exchange’s Secure Asset Fund for Users (SAFU), reported at roughly $1 billion in Bitcoin, would need to stretch far beyond its usual role if the final confirmed loss lands anywhere near the higher end of current estimates. No detailed compensation plan has been published yet.

For users and the broader market, the key unresolved questions are the same ones investigators are racing to answer:

What is the final, independently verified loss figure?

Which specific wallets and transactions belong to the attacker versus ordinary exchange operations?

What was the precise technical root cause, and has it been fully closed off?

When can deposits and withdrawals safely resume?

Until Binance publishes concrete answers, security researchers are advising users to treat circulating dollar figures as estimates rather than settled facts, and to rely only on the exchange’s official channels for updates rather than social media chatter.

Read Time:3 Minute, 38 Second

Trading Halted After Reports of Vanishing FundsPrediction market platform Polymarket temporarily suspended trading on October 29, 2026, after a wave of users reported funds missing from their wallets, unauthorized withdrawals, and open positions being closed without their consent. The company confirmed a security incident, said it had identified and fixed the underlying issue, and promised to reimburse affected traders before resuming trading shortly afterward.

In its public statement, Polymarket said the root cause traced back to a compromised third-party provider and that the matter had been referred to law enforcement, though it stopped short of naming the vendor involved. Subsequent reporting has connected the incident to DebugBear, a website performance-monitoring service, though Polymarket’s own statement did not confirm this directly.

Not Malware — A Script Riding Along on a Trusted ToolWhat makes this incident notable is how the theft was actually carried out. Security researchers at Hudson Rock say they found malicious JavaScript being served from a DebugBear-linked address associated with Polymarket’s site. Rather than simply measuring how fast pages loaded, as a performance-monitoring tool normally would, the script was quietly scanning the page for signs of an active trading session, pulling account details, and attempting to reuse the platform’s own trading functionality to move assets — all from inside a tab the user had already legitimately opened and logged into.

Specifically, the script reportedly read data sitting in the browser’s local storage, including account information, a wallet address, and trading API credentials, then searched through the page’s React application code to locate a live trading client and the signer component responsible for authorizing wallet actions. Rather than phishing for a password, the attack leveraged access that was already unlocked inside an open session — a technique that sidesteps many of the defenses built around login forms and credential theft.

Researchers observed the script attempting different tactics depending on the type of account it found: in some cases trying to transfer position tokens directly, in others attempting to sell open positions first and then move the resulting funds. The code was also seen requesting signatures and submitting transactions through Polymarket’s own relayer infrastructure. Hudson Rock noted it did not actually execute the malicious sample during testing, so its findings describe the script’s intended behavior rather than definitive proof every attempted transfer went through successfully.

Early Loss Estimates Remain UnofficialOutside analysis cited by financial media has linked at least $2.7 million in suspicious withdrawals to roughly 710 separate wallets, though that figure comes from independent trackers rather than an official Polymarket disclosure, and the company has not published a confirmed total loss. Reporting also indicates that Polymarket’s separate U.S.-facing platform was not affected, with the compromise limited to the international product.

On reimbursement, Polymarket has said affected users will be made whole, with smaller claims — reportedly those under $10,000 — restored quickly, while larger claims require submitting a formal release form before funds are returned. What remains unresolved publicly is the precise window during which the malicious script was live and exactly how the third-party provider itself was first compromised.

A Reminder That Trusted Third-Party Code Is an Attack SurfaceThis is not an isolated pattern. Security researchers have previously documented similar supply-chain-style attacks where legitimate, trusted scripts running on sensitive pages were quietly repurposed to steal cryptocurrency, including a prior case involving a compromised ad-tech script and a separate incident involving a tampered JavaScript package used in XRP wallet software. Each case used a different delivery method, but all shared the same underlying weakness: a trusted third-party script with broad access to the page it runs on.

For traders on any platform that integrates outside analytics, chat widgets, or monitoring tools, researchers recommend a few concrete precautions:

Close browser tabs with active trading sessions when they are not actively in use.

Review recent orders and wallet transactions directly through official platform channels, not links sent by email or social media.

Reject any unexpected wallet signing requests, even ones that appear to originate from a familiar app.

Never share a seed phrase, and treat unsolicited “recovery” links with suspicion.

Disconnecting a wallet after the fact does not undo transfers that already completed or revoke blockchain approvals granted earlier, so the most effective defense remains catching suspicious activity before a signature is approved — not after.