Binance and Polymarket Hacked Within Hours

Two separate security incidents landed on the same Thursday, 29 October 2026. In the afternoon US time, a booby-trapped script drained Polymarket users. A few hours later, billions left Binance’s hot wallets. No source has linked the two.[3]

Polymarket: A Monitoring Script Turned Wallet Drainer

Polymarket put its exchange into cancel-only mode at about 2:05 p.m. ET: you could cancel orders, but nothing new traded.[5] The cause was a third-party provider. Malicious JavaScript was served from the domain of DebugBear, a website performance-monitoring service whose snippet Polymarket’s site loaded.[5]

Once a visitor was logged in, the script used the trading session that was already open in the browser. Security firm Hudson Rock found it read login parameters, the proxy wallet address and trading API keys from browser storage. For accounts connected by a wallet it moved position tokens to the attacker. For email-login accounts it placed ever-lower sell orders and tried to move the proceeds out.[7] Polymarket’s smart contracts were not touched.[7]

• Loss: on-chain trackers put it at roughly $2.6–2.7 million; Arkham showed a suspected attacker wallet holding about $2.65 million in POL.[6] Polymarket has not published a figure or a count of affected users.
• Response: Polymarket said the provider “was compromised,” that it referred the case to law enforcement, and that “anyone who has been impacted will be made whole.” Trading resumed about an hour after the halt.[5]
• DebugBear: asked all customers of its monitoring product to remove the embed code and has not explained how it was breached.[5] Hudson Rock found no sign of other customers being hit, but could not say how long the script was live.[7]

Binance: Hot Wallets Emptied Within Minutes

Arkham’s CEO dated the start of the Binance outflows to around 4:30 p.m. ET.[2] Blockhead’s timeline has a single transaction at about 20:24 UTC moving 167,464 ETH, around 1.6 billion USDT and dozens of other tokens out of the hot wallet labelled Binance 14, with transfers from two more hot wallets following within minutes.[3] Blockaid’s reading: the attacker used Ethereum’s EIP-7702 feature to point the wallet at an unverified “sweeper” contract. Binance has not confirmed that method. Its initial investigation, as relayed by Cointelegraph, points to a compromised DevOps engineer’s laptop that may have given access to a service container and let the attacker submit unauthorised withdrawals, with no evidence of a private-key leak. The investigation is ongoing.[8]

The Statements, In Order

1. Binance, first post on X: “Our teams are aware of reports of a potential security issue and are actively investigating.”[4] The follow-up first said it had “not confirmed any impact to user funds,” then was edited to read “User funds are completely safe.”[3]
2. CZ, 5:52 p.m. ET: “User funds are safe! It does look like a hack on Binance.” He thanked Tether and Circle for the freezes and added: “I don’t manage Binance (.com) anymore, but as a shareholder, I expect all user funds will be fully covered.”[1] That is an expectation from a former CEO, not a commitment by the company.
3. Co-CEO Yi He, later that night: “User funds are safe. Binance will cover all hacking losses.” Deposits and withdrawals were temporarily suspended.[4]
4. Binance: withdrawals return once the security issue is resolved, and a full post-mortem is coming.[2] There is no resumption date. Early on 30 October Binance estimated the total impact at $6.3 billion, as reported by Cointelegraph, and has not published a final loss figure.[8]

Freezes and Fallout

Stablecoin issuers moved fast. Tether’s Paolo Ardoino said more than 1.567 billion USDT was frozen; Circle’s Jeremy Allaire said more than 800 million USDC, “in coordination with law enforcement.” Binance’s verified frozen total went from $2.54 billion to $3 billion overnight.[3][8] ETH cannot be frozen by an issuer, and Blockhead reports about 195,000 stolen ETH moved on to a second address.[3] The Arbitrum Security Council froze 74.56 million tokens in the attacker’s wallet.[2]

Elsewhere: Bybit said it was “not affected,” Aave froze its lending markets while saying its contracts were unaffected, and market maker Wintermute reported exposure under 20% of net equity.[2] Bitcoin slid to just under $77,000 and BNB dropped about 8%.[2]

Why The Numbers Don’t Agree

Estimates run from about $2.8–3.5 billion traced to the Ethereum drain, to $5.3–5.9 billion from trackers that also count roughly 18,000 BTC and Tron outflows not tied to the same attack.[3] Frozen amounts differ too, because CZ’s first post cited the earlier ~$971 million and ~$823 million, and the issuers’ own later figures were higher.[1][3] Binance’s own $6.3 billion impact estimate sits above both. Treat every total as preliminary until Binance publishes its accounting. Its next proof-of-reserves snapshot is due 1 November.[3]

What This Means If You Gamble With Crypto

• Don’t send a casino payout to a Binance address right now. Deposits are suspended, so check Binance’s status first or withdraw to a wallet you control. Some of our reviewed casinos accept Binance Pay or direct exchange deposits, for example 22bit and Gamdom.
• Prediction-market casinos: Roobet and BC.Game run Polymarket-sourced markets, covered in our prediction-market casino ranking. The script sat on polymarket.com, and none of the reports we read mention casino integrations being affected.
• The weak point was the website, not the blockchain. A third-party script ran with the permissions of your open session, the same class of risk we describe in crypto casino wallet security. If you used Polymarket.com on 29 October, Hudson Rock advises rejecting unexpected signing requests, closing old tabs and reviewing active sessions and API credentials.[7]
• Hot wallets are a recurring target. The Duelbits hot wallet hack in September was about $7 million; this one is hundreds of times larger. Curaçao’s new rules limit casino hot wallets to operationally necessary balances, see what changes for Curaçao casinos.