Security

Polymarket

<ul>
 <li>Binance estimates a $6.3 billion impact; frozen assets are not completed recoveries.</li>
 <li>Polymarket restored service after a third-party compromise; forensic estimates remain provisional.</li>
 <li>Verify official updates and avoid fake support, refund links and recovery-fee scams.</li>
</ul>
<p style="margin:0 0 1.25em;"><em>Developing report | Reporting checked October 30, 2026, 2:46 a.m. Eastern (GMT−04:00). Event times below are Eastern (GMT−04:00).</em></p>
<p style="margin:0 0 1.25em;">Binance and Polymarket disclosed separate security incidents on October 29. Binance estimates a multibillion-dollar impact and continues to restrict withdrawals. Polymarket says it fixed a compromise involving an outside provider and has restored trading. The available evidence does not establish a connection between the two incidents.</p>
<p style="margin:0 0 1.25em;">The immediate questions are different for each platform: what funds moved, which services remain restricted, and how promised compensation will work. A company assurance, an on-chain transfer and a completed reimbursement are three different kinds of evidence.</p>
<h2 style="margin:1.8em 0 .7em;" id="binance-a-6-3-billion-estimate-not-a-final-loss-account">BINANCE: A $6.3 BILLION ESTIMATE, NOT A FINAL LOSS ACCOUNT</h2>
<p style="margin:0 0 1.25em;">In its <a href="https://www.binance.com/en/square/post/382713227024938" rel="noopener noreferrer nofollow">official incident statement</a>, Binance put the estimated impact at approximately $6.3 billion and said about $3 billion had been frozen on-chain with partners. It pledged to cover losses using its SAFU fund and company resources, and to publish a technical post-mortem and updated proof of reserves after remediation.</p>
<p style="margin:0 0 1.25em;">Those are company statements, not independent confirmation that affected customers have already been compensated. Frozen assets are not necessarily recovered or returned; subtracting the frozen amount from the impact estimate would not produce an audited net loss.</p>
<p style="margin:0 0 1.25em;">Binance's preliminary account points to a compromised DevOps engineer's laptop, access to a service container and unauthorized withdrawal requests. It said it had found no evidence of a wallet-private-key leak. The root cause remains under investigation.</p>
<p style="margin:0 0 1.25em;">A <a href="https://www.binance.com/en/square/post/10-30-2026-binance-says-deposits-normal-withdrawals-paused-for-security-revamp-eyes-48-hour-restoration-382748430882486" rel="noopener noreferrer nofollow">newer update from the verified Binance News account</a> says deposits are operating normally while withdrawals remain paused during a security overhaul. Binance expects withdrawals to resume within 48 hours; that is an estimate, not a guaranteed reopening time. Earlier restrictions should not be mistaken for the latest status, or described as a blanket trading halt.</p>
<h2 style="margin:1.8em 0 .7em;" id="what-the-binance-on-chain-analysis-shows">WHAT THE BINANCE ON-CHAIN ANALYSIS SHOWS</h2>
<p style="margin:0 0 1.25em;"><a href="https://www.trmlabs.com/resources/blog/north-korea-steals-usd-6-36-billion-from-binance-in-the-largest-hack-in-history" rel="noopener noreferrer nofollow">TRM Labs' investigation</a> estimates approximately $6.36 billion moved from Binance-attributed wallets across ten blockchains, valued at transfer-time prices. Its snapshot ends at 8:30 p.m. on October 29. TRM says most funds moved within roughly 20 minutes starting around 4:05 p.m.</p>
<p style="margin:0 0 1.25em;">TRM describes an Ethereum EIP-7702 authorization that delegated a hot wallet's behavior to malicious code, alongside ordinary signed transfers on other chains. Its assessment is that the signing infrastructure was compromised. A valid blockchain signature demonstrates acceptance by the network; it does not, by itself, reveal who requested it or prove that a private key was stolen.</p>
<p style="margin:0 0 1.25em;">TRM attributes the attack to the North Korea-linked TraderTraitor group with high confidence. That remains TRM's attribution, not a finding independently established by CoinRank. Its $6.36 billion outflow estimate is not additional to Binance's $6.3 billion figure. Different timestamps, prices and asset coverage can produce different totals.</p>
<h2 style="margin:1.8em 0 .7em;" id="polymarket-third-party-compromise-and-restored-service">POLYMARKET: THIRD-PARTY COMPROMISE AND RESTORED SERVICE</h2>
<p style="margin:0 0 1.25em;"><a href="https://status.polymarket.com/cmvtuswgi00221bkzps7w21pt" rel="noopener noreferrer nofollow">Polymarket's official incident record</a> shows its international platform entered cancel-only mode and paused its transaction relayer at 2:05 p.m. on October 29. At 2:37 p.m., it said an outside provider had been compromised, the issue had been fixed, law enforcement had been contacted and affected users would be made whole. The status page marked the incident resolved at 3:05 p.m.</p>
<p style="margin:0 0 1.25em;">That record concerns Polymarket.com; it should not be presented as evidence of a breach at Polymarket US. Nor does a restored service status establish that every affected balance has been reimbursed.</p>
<p style="margin:0 0 1.25em;"><a href="https://www.infostealers.com/article/polymarket-breach-alert-wallet-draining-code-found-in-a-third-party-script/" rel="noopener noreferrer nofollow">Hudson Rock's technical investigation</a> found wallet-draining functionality in a third-party script associated with the site. Its analysis describes attempts to access trading functions, sell positions and move assets. Static code analysis establishes what code attempts to do, not that every operation succeeded. The researchers explicitly distinguish wallet-balance snapshots from a verified total loss.</p>
<h2 style="margin:1.8em 0 .7em;" id="polymarket-s-chain-record-an-estimate-with-a-cutoff">POLYMARKET'S CHAIN RECORD: AN ESTIMATE WITH A CUTOFF</h2>
<p style="margin:0 0 1.25em;"><a href="https://bitquery.io/investigations/polymarket-hack" rel="noopener noreferrer nofollow">Bitquery's investigation</a> estimates $2.73 million left 737 accounts between 1:10 and 2:10 p.m. on October 29. It traced transfers into a specified receiving address and subsequent movements on Polygon and Ethereum, with coverage ending at 3:49 p.m. Wallets or accounts are not necessarily separate people.</p>
<p style="margin:0 0 1.25em;">Its dollar methodology treats pUSD, USDC and USDC.e as $1 and uses a specified price snapshot for POL and ETH. Other receiving routes are excluded, and outcome shares are not dollar-valued. This is a scoped research estimate, not a final platform-wide loss total.</p>
<p style="margin:0 0 1.25em;">Bitquery also reports a further approximately $10.99 transfer at 3:11 p.m.—after the official status page marked the incident resolved. That observation merits clarification, but does not prove that an exploit remains active now.</p>
<p style="margin:0 0 1.25em;">The researchers list <a href="https://polygonscan.com/tx/0xc6fcf3a65c85eb322fe41c193f74bb37845e19be29364b126d3ea7a149f78dcc" rel="noopener noreferrer nofollow">this Polygon transaction</a> among their evidence. CoinRank reviewed the published methodology but could not independently retrieve the explorer receipt during preparation. The transaction-level claims above are therefore attributed to Bitquery, not presented as our own reconstruction.</p>
<h2 style="margin:1.8em 0 .7em;" id="what-to-watch-next">WHAT TO WATCH NEXT</h2>
<p style="margin:0 0 1.25em;">The useful next evidence is operational, not another larger headline number: Binance's withdrawal reopening and technical post-mortem; both platforms' compensation procedures and completed payments; and updated forensic reports that reconcile transfers, freezes, returns and valuation times.</p>
<p style="margin:0 0 1.25em;">For users, a functioning website is not the same as a completed security investigation. For analysts, multiple hops of the same assets should not be added together as fresh losses. Neither the companies' reimbursement promises nor an investigator's wallet labels should be treated as guarantees.</p>
<h2 style="margin:1.8em 0 .7em;" id="avoid-a-second-loss-to-fake-support">AVOID A SECOND LOSS TO FAKE SUPPORT</h2>
<p style="margin:0 0 1.25em;">The <a href="https://www.fbi.gov/how-we-can-help-you/victim-services/seeking-victim-information/seeking-victim-information-in-cryptocurrency-recovery-fraud-investigation" rel="noopener noreferrer nofollow">FBI warns that cryptocurrency-recovery fraudsters</a> approach victims through social media, impersonate recovery professionals and request fees without recovering funds. Treat unsolicited refund or support messages as unverified.</p>
<ul>
 <li style="margin-bottom:.7em;">Open the platform through a known official address or app, not a direct-message link, search advertisement or reply claiming to be support.</li>
 <li style="margin-bottom:.7em;">Never disclose seed phrases, private keys, passwords or one-time codes to anyone claiming to handle compensation.</li>
 <li style="margin-bottom:.7em;">Do not connect a wallet or sign an unexpected transaction, approval or message to “verify” a refund. Do not run commands supplied by a verification page.</li>
 <li style="margin-bottom:.7em;">Do not pay an advance recovery, tax or unlocking fee to someone promising to return stolen assets. A promise of guaranteed recovery is a warning sign.</li>
 <li style="margin-bottom:.7em;">Preserve transaction hashes, addresses, token amounts, times and correspondence for the platform's official support process and the relevant authorities. Avoid posting sensitive account information publicly.</li>
</ul>
<p style="margin:0 0 1.25em;"><em>Prepared with AI assistance and editorial source checking. This is a developing report; company statements and third-party forensic assessments are identified separately.</em></p>
<p>〈<a href="https://www.coinrank.io/crypto/binance-polymarket-security-incidents-october-2026/" rel="noopener noreferrer nofollow">Binance and Polymarket Security Incidents: What Is Confirmed and What the Chain Shows</a>〉這篇文章最早發佈於《<a href="https://www.coinrank.io" rel="noopener noreferrer nofollow">CoinRank</a>》。</p>

Binance and Polymarket Security Incidents: What Is Confirmed and What the Chain Shows

Table of Contents

CoinRank_io

Other articles published on Oct 30, 2026

Join our free newsletter for daily crypto updates!