Crypto’s US$6.3-Billion Shock: Binance Reports Massive Breach as Polymarket Is Also Hit
Two separate theft incidents, ten blockchain networks and billions in frozen assets. What the evidence supports—and why stolen, frozen and recovered are three different numbers.
AI-created editorial illustration for Public Relations Canada. Symbolic artwork, not a photograph of Binance infrastructure, a compromised device or an actual attack.
October 30, 2026 · By Justin Plosz · Calgary, Alberta · Finance · 12 min read read
A US$6-billion-plus breach—not a final US$6-billion customer-loss bill
**CALGARY, Alberta — October 30, 2026.** Binance has reported a security incident with an estimated **US$6.3-billion total impact**, after unauthorized withdrawals from wallets associated with the exchange. The scale is independently supported by blockchain intelligence firm TRM Labs, which traced approximately **US$6.36 billion** in outflows across ten networks. A separate compromise affecting Polymarket’s international platform occurred earlier the same day.
The answer to the central question—was more than US$6 billion involved?—is **yes, according to Binance’s estimate and TRM’s tracing**. But that is not a final audited statement of unrecoverable loss, and the estimates are not unanimous: Cointelegraph reported Chainalysis’ preliminary valuation at **US$5.912 billion**. Different coverage, prices and snapshots matter.
[Binance’s own update](https://www.binance.com/en/support/announcement/detail/c5a8729a97ac486d963784d96c5642d7) says about **US$3 billion had been frozen on-chain** and promises to cover losses using its Secure Asset Fund for Users, or SAFU, and company funds. That is a company commitment, not independent proof that reimbursement has been completed or an audited finding about its reserves.
**Reporting window:** October 28, 2026 at 06:08 UTC through October 30 at 06:08 UTC—October 28 at 12:08 a.m. through October 30 at 12:08 a.m. in Alberta, on Mountain Daylight Time. This is a fixed 48-hour review, not a live ticker. All dollar amounts below are US dollars unless expressly stated otherwise.
Read Binance’s Security Incident Update
The two distinct theft incidents established in this review
| Incident | What the sources establish | Amount and status at the cutoff |
| --- | --- | --- |
| Binance, October 29 | Unauthorized withdrawals; Binance acknowledges a security incident. TRM traces outflows on ten networks. | Binance estimates US$6.3 billion in impact; TRM estimates US$6.36 billion in outflows. Binance reports about US$3 billion frozen. |
| Polymarket international platform, October 29 | Polymarket says a third-party provider was compromised; independent tracing identifies drained user accounts. | Bitquery traces about US$2.73 million from 737 accounts. Polymarket promises reimbursement; its status page marks the outage resolved. |
These are **two incidents, not a list of independently hacked coins**. The reported Binance estimate alone exceeds the US$6-billion threshold. Adding Polymarket’s much smaller estimate produces roughly US$6.3 billion at sensible headline precision—not a newly verified, exact industry loss total.
No public search can guarantee discovery of every private or undisclosed theft. This review includes the distinct in-window incidents supported by the sources examined and separates earlier incidents and non-theft disclosures below.
Read Bitquery’s Polymarket on-chain investigation
Which cryptocurrencies and networks were involved?
The clearest published cross-chain breakdown comes from [TRM’s original analysis](https://www.trmlabs.com/resources/blog/north-korea-steals-usd-6-36-billion-from-binance-in-the-largest-hack-in-history). Its figures value transfers at the time the assets left Binance-attributed wallets. **The network rows are subtotals of the same incident; the named tokens inside each row are not additional losses to add again.**
| Network or group | Reported assets and approximate outflow value |
| --- | --- |
| Ethereum | About US$3.79 billion, including 200,630 ETH and 185 other tokens; major token amounts include 1.875 billion USDT, 823 million USDC and 88.5 million RLUSD. |
| Bitcoin | 18,270 BTC, about US$1.47 billion. |
| Tron | 612.7 million USDT and 46.4 million TRX, about US$628 million combined. |
| XRP Ledger | 233.46 million XRP, about US$296 million. |
| Solana | 970,500 SOL, about US$96 million. |
| Arbitrum, Optimism and Base | About US$39 million combined, including 74.6 million ARB on Arbitrum. |
| Avalanche | About US$28 million. |
| Polygon | About US$10 million. |
The rounded subtotals reconcile to approximately US$6.36 billion. They cover **ten networks**, because the Arbitrum/Optimism/Base row groups three. They are not ten separate attacks on those networks’ consensus or cryptography.
Additional tokens named in the [contemporaneous freeze reporting](https://cointelegraph.com/news/binance-linked-wallet-faces-possible-exploit-blockchain-researcher-warns) include **USD1, XUSD, USDT0, WBETH, XAUT, PAXG and USDP**; First Digital also confirmed a freeze involving **FDUSD**. LlamaRisk reported the exploiter selling **UNI, LINK and AAVE**. Those disclosures identify exposure or response activity, but do not provide a complete, reconciled dollar loss for every token. A freeze announcement is not evidence that the issuing company or token’s own contracts were hacked.
In the separate Polymarket case, Bitquery describes account balances moving through **pUSD and USDC**, then being converted to **POL** through the withdrawal route, with funds subsequently moving toward Ethereum. That is separate accounting from Binance’s Polygon subtotal.
The timeline: two attacks, followed by a race to freeze funds
**October 29, 17:10–18:10 UTC:** Bitquery traces the principal Polymarket drain to this hour. The platform’s status history records trading restrictions and paused relayer actions starting at 18:05 UTC. At 18:37 UTC it attributes the problem to a third-party compromise; at 19:05 UTC it marks the outage resolved. Bitquery also reports a further account drain at 19:11 UTC—an important reason not to equate a resolved outage banner with a completed forensic reconciliation.
**October 29, from 20:05 UTC:** TRM traces the Binance episode’s first thefts on the XRP Ledger, followed by other networks. Bitcoin outflows and the Ethereum wallet delegation appear around 20:20 UTC; the large Ethereum sweep follows minutes later. TRM identifies further activity later that evening, including a second wave around 23:05 UTC.
**October 29 into October 30:** Binance suspends withdrawals and then deposits while security checks proceed. Stablecoin issuers and blockchain partners freeze or immobilize assets. Binance’s verified frozen total rises from **US$2.54 billion** to about **US$3 billion**, as recorded in Cointelegraph’s time-stamped updates. Those successive totals replace earlier estimates; they must not be added together.
The Binance announcement’s displayed publication clock does not identify its timezone. This timeline therefore uses the explicitly UTC-dated security analyses and live reporting rather than treating that display as an exact UTC event time.
Read the time-stamped Binance incident updates
How the Binance breach may have worked
Binance’s **initial** explanation points to a compromised DevOps engineer’s laptop, potentially allowing access to a service container and unauthorized withdrawal transactions. The exchange says it has found no evidence of a wallet private-key leak and will issue a fuller technical account after investigation.
TRM’s assessment focuses on **signing infrastructure**: the systems that authorize an exchange’s outgoing transactions. Its Ethereum analysis describes a pre-signed EIP-7702 authorization used to delegate wallet behaviour to attacker-controlled code. Activity on other networks used ordinary signed transfers, which TRM says points to a broader authorization compromise rather than an Ethereum-only flaw.
For a nontechnical reader, the distinction is important: a transaction can carry a valid digital signature and still be unauthorized by the business if an attacker has compromised the approval process. Neither a valid signature nor the absence of a discovered private-key leak establishes that the withdrawal was legitimate.
This remains a preliminary company explanation alongside an outside security firm’s analysis—not a completed, independently audited root-cause report. It does not establish that Bitcoin, Ethereum, Solana or the other underlying networks were themselves broken.
Frozen, recovered and lost: the numbers are not interchangeable
**Gross impact or outflows:** Binance’s roughly US$6.3 billion and TRM’s roughly US$6.36 billion describe the scale of the incident under different methodologies. TRM also publishes a lower later-price valuation of the same assets, illustrating how moving prices affect dollar comparisons.
**Frozen:** Binance reports about US$3 billion. TRM’s earlier 00:30 UTC snapshot tallies roughly US$2.7 billion, largely stablecoins plus an Arbitrum emergency intervention. Different timestamps and evidence coverage mean these are not a single synchronized ledger.
**Recovered and returned:** A token freeze stops transfers or restricts control; it does not automatically return legal ownership, restore customer balances or complete restitution. The reviewed sources did not establish a final, reconciled amount returned by the cutoff. Nor should US$6.3 billion minus US$3 billion be published as a final customer-loss bill.
Binance says it revoked the affected address authorization, engaged law enforcement and blockchain intelligence partners, and will publish updated proof of reserves after remediation. Its coverage pledge is relevant, but the final reserve position, recoveries and customer settlement still require evidence.
Read CoinDesk’s reporting on the amounts and response
Aave and Uniswap: response and fund movement are not new hacks
LlamaRisk’s [Aave governance update](https://governance.aave.com/t/binance-hot-wallet-exploit-aaves-response/25954) says an exploiter-linked wallet deposited **60 million USDT** and borrowed **19,762 WETH**, worth about US$44.6 million at the time. That is activity involving proceeds of the Binance incident—not a separate US$44.6-million theft to add to its total.
Aave froze new supply and borrowing across affected markets as a precaution. LlamaRisk said users could still withdraw and repay, and liquidations continued. Its update described the attacker’s position as overcollateralized and said it did not put Aave suppliers at risk at that snapshot. Conditions and reopening decisions could change after this article’s cutoff.
Investigators also observed swaps through decentralized trading routes, including Uniswap-related infrastructure. Use of a protocol to trade or move stolen assets does **not**, by itself, establish that the protocol was hacked or knowingly assisted the attacker.
Read Aave’s published incident-response discussion
Who is suspected—and what has not been proven?
TRM Labs attributes the Binance attack to **TraderTraitor**, a North Korean hacking unit, with what the firm describes as high confidence. A [Reuters dispatch reporting TRM’s assessment](https://www.marketscreener.com/news/blockchain-analysis-firm-trm-says-north-korea-behind-binance-crypto-theft-ce785fdad08ef723) and CoinDesk’s reporting corroborate that this attribution was made. CoinDesk also reports suspicions from Blockaid and investigator ZachXBT.
The careful wording is **“TRM attributes the attack to North Korea’s TraderTraitor”**, not “PRC has proven North Korea did it.” The firm cites on-chain and off-chain intelligence, not all of which is public. Binance says it is working with law enforcement to identify the criminals. A security-company assessment is not a court finding or a publicly verified government attribution.
The reviewed evidence does not establish a common attacker or coordinated operation linking the Binance and Polymarket incidents. Their occurrence on the same date is not sufficient proof of a connection.
Polymarket: a separate provider compromise and reimbursement promise
Polymarket’s [own incident record](https://status.polymarket.com/cmvtuswgi00221bkzps7w21pt) says a third-party provider serving its international platform was compromised, that the issue was identified and fixed, and that affected users would be made whole. It also records the temporary trading halt and subsequent service restoration.
[Bitquery’s tracing](https://bitquery.io/investigations/polymarket-hack) estimates **US$2.73 million from 737 accounts** in the main one-hour drain. [CoinDesk’s separate Polymarket report](https://www.coindesk.com/markets/2026/10/29/polymarket-suspends-trading-after-third-party-breach-leads-to-user-losses) cites roughly US$2.7 million, while [CNBC’s reporting](https://www.cnbc.com/2026/10/29/polymarket-reports-outage-on-international-exchange-halts-trading.html) independently covers the user losses and provider compromise.
These are traced or reported amounts, not a final platform-wide settlement. Polymarket had not named the outside provider in its incident notice. Bitquery’s analysis identifies apparently valid account approvals and the platform’s relayer rather than a broken smart contract; the precise source of those approvals remained a forensic question.
A reimbursement promise is not proof every affected person has already been paid. This episode should also not be confused with Polymarket’s separate June 2026 vendor incident.
Read Polymarket’s original incident history
Other headlines that must not inflate the 48-hour theft total
**Coinbase / Amplitude:** [CoinDesk’s report](https://www.coindesk.com/tech/2026/10/28/coinbase-says-customer-funds-are-safe-after-third-party-vendor-exposes-customer-contact-info) describes exposure of some customer contact data through analytics vendor Amplitude. Coinbase says its own systems were not accessed without authorization and customer funds were safe. The report’s actual publication timestamp is October 28 at 03:11 UTC—before this window—even though its URL carries October 28. It is context, not a new asset theft in this calculation.
**Tampered Ledger devices:** Singapore Police’s [October 28 advisory](https://www.police.gov.sg/Media-Hub/News/2026/10/20261028_police_advisory_on_tampered_cryptocurrency_hardware_wallets) warns about malicious hardware components in devices bought from some retail stores. It covers cases reported since September 10, not a newly established theft total occurring entirely in these 48 hours.
**Avalanche Tranche Vault:** [Unchained’s October 28 report](https://unchainedcrypto.com/flash-loan-attacker-drains-about-1-million-in-usdc-from-avalanche-based-tranche-vault) describes an approximately US$1-million USDC exploit that occurred before this review’s starting time. **Prabang:** [Seoul Economic Daily’s October 29 report](https://en.sedaily.com/finance/2026/10/29/crypto-exchange-prabang-loses-100-million-won-in-hack) dates the abnormal withdrawals to October 24. Neither belongs in the strict in-window incident total.
A publication date is not an attack date. Neither customer-data leaks nor a new article about an older theft should be silently added to a fresh 48-hour loss figure.
Market fallout is real—but falling prices are not stolen money
CoinDesk reports sharp declines in Bitcoin, Ether and BNB during the Binance news, with additional weakness in some decentralized-finance tokens. Such price changes affect holders who were never directly touched by the compromised wallets. They are market losses, not proof that those holders’ coins were stolen.
Leveraged liquidations are another separate category: positions can be automatically closed as collateral loses value. **Do not add liquidations, market-cap declines, borrowed WETH or every successive freeze announcement to the theft estimate.** Doing so can count the same economic event several times.
The comparison is already significant without exaggeration. TRM describes the Binance incident as the largest crypto theft on record, roughly four times the US$1.5-billion Bybit breach of February 2025. That is TRM’s comparison using its gross outflow estimate; the older Bybit theft is not part of this window.
What Canadian readers should do now
For Canadians, the immediate tasks are verification, account security and evidence preservation—not responding to unsolicited “recovery” offers. The [Canadian Securities Administrators](https://www.securities-administrators.ca/crypto-platforms-regulation-and-enforcement-actions) maintain information about authorized crypto trading platforms and enforcement. Check the live regulator list and the exact legal entity holding your assets; a familiar brand is not proof of Canadian authorization.
Binance’s Canadian withdrawal was documented by the [Nova Scotia Securities Commission in 2023](https://nssc.novascotia.ca/before-you-invest/why-did-binance-exit-canada). This article does not establish current Canadian authorization or a number of Canadian victims. [Federal consumer guidance](https://www.canada.ca/en/financial-consumer-agency/services/payment/digital-currency.html) also makes clear that crypto assets are not covered by federal, provincial or territorial deposit-insurance plans. Registration is not a blanket guarantee against loss.
Use a trusted bookmark or independently located official support channel. Never disclose a recovery phrase, private key, password or verification code to someone claiming to process compensation. If you suspect actual loss, preserve transaction hashes, wallet addresses, account records, messages and relevant times; notify the platform and local police and use the [Canadian Anti-Fraud Centre’s reporting page](https://antifraudcentre-centreantifraude.ca/report-signalez-eng.htm).
The [CAFC’s investment-fraud guidance](https://antifraudcentre-centreantifraude.ca/scams-fraudes/investment-investissement-eng.htm) specifically warns that past victims can be approached again with supposed fund-recovery services. Do not pay a stranger an advance fee or grant remote access based on a promise to retrieve stolen crypto. Self-custody introduces its own risks, including seed loss and malicious hardware; it is not an automatic cure for every security problem.
Check Canadian crypto-platform regulation and registration
Editor’s note: what this release verifies—and what remains open
This is an independent **Public Relations Canada news release**, not a statement issued by Binance, Polymarket, a regulator or a law-enforcement agency. It was compiled from original disclosures, published blockchain analyses and independent reporting available for the fixed cutoff stated above. PRC did not conduct interviews, obtain internal forensic records or independently audit every transaction.
**Supported:** Binance acknowledges unauthorized withdrawals and estimates US$6.3 billion in impact; TRM independently estimates US$6.36 billion across ten networks; Polymarket acknowledges a separate provider compromise, with approximately US$2.73 million traced by Bitquery. **Not established:** a final audited loss, final customer reimbursement, a complete public token-by-token ledger, every undisclosed incident worldwide, or independently proven attacker identity.
Core sources are linked beside the claims: [Binance](https://www.binance.com/en/support/announcement/detail/c5a8729a97ac486d963784d96c5642d7), [TRM Labs](https://www.trmlabs.com/resources/blog/north-korea-steals-usd-6-36-billion-from-binance-in-the-largest-hack-in-history), [CoinDesk](https://www.coindesk.com/business/2026/10/29/potential-multi-billion-binance-hack-hitting-crypto-markets), [Cointelegraph’s UTC updates](https://cointelegraph.com/news/binance-linked-wallet-faces-possible-exploit-blockchain-researcher-warns), [Aave/LlamaRisk](https://governance.aave.com/t/binance-hot-wallet-exploit-aaves-response/25954), [Polymarket’s status history](https://status.polymarket.com/cmvtuswgi00221bkzps7w21pt) and [Bitquery](https://bitquery.io/investigations/polymarket-hack). Additional reporting and official consumer sources are linked in their relevant sections. Amounts are estimates with different snapshot times; they should not be read as a synchronized or final balance sheet.
The practical conclusion is serious enough without a misleading headline: **published company and independent tracing estimates put the Binance incident above US$6 billion, while billions frozen, a separate Polymarket theft and unresolved forensic questions make precision essential.**
Key takeaways
- Binance estimates US$6.3 billion in impact; TRM Labs independently traces US$6.36 billion, while Chainalysis’ reported preliminary estimate is lower.
- The reviewed 48-hour window establishes a major Binance incident and a separate approximately US$2.73-million Polymarket theft—not ten independently hacked blockchains.
- Binance reports about US$3 billion frozen; freezing is not the same as recovery, reimbursement or a final net-loss figure.
- BTC, ETH, stablecoins and other tokens were involved, but a complete, reconciled public token-by-token loss ledger remained unavailable.
- TRM’s North Korea attribution and Binance’s proposed laptop-compromise explanation remain attributed assessments, not PRC forensic findings.
- Data leaks, older hardware-wallet thefts, market declines and leveraged liquidations must not inflate the new theft total.
- This independent PRC release uses a fixed October 30, 2026, 06:08 UTC cutoff; final losses, recoveries and customer settlements remained unresolved.
Frequently asked questions
- Was more than US$6 billion stolen in crypto hacks in the last 48 hours?
- Binance reported a preliminary US$6.3-billion security-incident impact on October 29, 2026, and TRM Labs independently traced about US$6.36 billion in outflows. Those estimates support the US$6-billion-plus scale, but not a final audited loss. A separate Polymarket incident was traced at about US$2.73 million. Most of the headline amount belongs to one Binance breach, not many independent coin hacks.
- Which cryptocurrencies were affected by the Binance breach?
- TRM’s analysis identifies BTC, ETH, USDT, USDC, XRP, SOL, TRX, RLUSD and ARB among assets moved across ten networks. Other incident reporting names USD1, XUSD, USDT0, WBETH, XAUT, PAXG, USDP and FDUSD in freeze activity, and UNI, LINK and AAVE in sales. No complete public, reconciled loss ledger for every token had been established at the cutoff.
- Were Bitcoin and Ethereum themselves hacked?
- The reviewed evidence points to unauthorized withdrawals from Binance-associated wallets and a possible compromise of exchange authorization infrastructure. It does not establish a breach of Bitcoin’s or Ethereum’s underlying consensus or cryptography. Assets on ten networks can be taken in one exchange incident without ten separate blockchain hacks.
- Has Binance recovered the stolen funds?
- Binance said about US$3 billion was frozen on-chain. Frozen assets are not automatically recovered, legally returned or paid back to customers. Binance promised to cover losses through SAFU and company funds, but the reviewed sources did not establish a final recovery and reimbursement reconciliation by the cutoff.
- Was Polymarket also hacked on October 29, 2026?
- Polymarket said an outside provider serving its international platform was compromised and promised to make affected users whole. Bitquery traced approximately US$2.73 million from 737 accounts during the principal one-hour drain. This was a separate incident from Binance, and a resolved outage did not by itself prove all affected users had been reimbursed.
- Is North Korea confirmed to be responsible for the Binance attack?
- TRM Labs attributes the Binance attack to North Korea’s TraderTraitor with high confidence. That is a security-firm assessment reported by Reuters and other outlets, not PRC’s independent proof, a court finding or a publicly verified government attribution at this article’s cutoff.
- Are Canadian crypto holdings protected by deposit insurance?
- Federal consumer guidance says crypto assets are not covered by federal, provincial or territorial deposit-insurance plans. Check the CSA’s current list of authorized platforms, use official support channels, never share a recovery phrase, and report suspected theft to the platform, local police and the Canadian Anti-Fraud Centre.
← Back to PRC Newsroom · Public Relations Canada
Enable JavaScript to view the interactive version of this page.