Binance Hack and Polymarket Hack: How $6.3B Walked Out Through a Laptop and a Speed Script
The Binance hack is now the largest crypto theft on record: about $6.3 billion moved out of Binance hot wallets on October 29, 2026, through one compromised engineer laptop and a stack of pre-signed EIP-7702 authorizations, not a broken smart contract. Three hours earlier the same day, a hijacked page-speed script on Polymarket drained about $2.7 million from roughly 700 traders who were sitting on the real website and did nothing wrong.
Key takeaways
- Binance: an attacker reached a service container from a DevOps engineer's laptop, got Binance's own signing pipeline to produce 50 EIP-7702 authorizations, and swept hot wallet Binance 14 in one transaction. Impact about $6.3B, about $3B frozen, Binance covering the rest.
- Polymarket: DebugBear's real-user monitoring script was swapped for a drainer at the same URL. It ran as first-party code, used each trader's live session and signer, and dumped positions through Polymarket's own relayer. About $2.7M from roughly 700 accounts in one hour.
- Neither hack touched a smart contract or stole a private key. Both borrowed trust that the system already granted: a script on the money page, and a laptop one hop from the signer.
- The freeze race mattered. Tether and Circle froze about $2.4B in stablecoins within an hour, but the Binance attacker had already parked $60M USDT in Aave and borrowed ETH, which cannot be frozen. The Polymarket drainer swapped straight into POL for the same reason.
- TRM Labs attributes the Binance theft to North Korea's TraderTraitor. Binance has promised a full technical post-mortem.
- If your product has a login, a payment form or a withdraw button, both attack paths exist in your stack today. The checklist at the end takes an afternoon.
Published October 30, 2026. Last updated October 30, 2026, 05:40 UTC. Developing story. Our team reconstructed both timelines from official statements by Binance, Polymarket and DebugBear, from on-chain data, and from the analysts who traced the money live on X (Blockaid, TRM Labs, Bitquery, Hudson Rock, Bubblemaps). Where figures disagree we show every source. We will update this page when Binance publishes its post-mortem.
October 29 in one picture
Two very different targets, one exchange holding about $144 billion in customer assets and one prediction market, were emptied on the same afternoon by the same idea. Nobody cracked any cryptography. The attackers found a component that the system already trusted with money and simply asked it to move.
How the Polymarket hack worked: a JavaScript supply chain attack
Polymarket's international site, polymarket.com, loaded a small JavaScript file from DebugBear, a UK vendor that measures how fast pages load for real users. On October 29, the file at DebugBear's own CDN address was replaced with a drainer. The URL did not change, so the browser treated it exactly like Polymarket's own code. That is a textbook software supply chain attack: the attacker never touched Polymarket's servers, only a vendor whose code Polymarket's pages pulled in. The US platform and MetaMask's Polymarket integration, which do not use that frontend, were not affected.
What the drainer actually did
Security researchers who pulled the payload, including Hudson Rock and several independent tracers, describe a tidy piece of work:
- It read the page's wallet and auth state, then walked React's internals to hook the live trading client and the signer the user was already logged in with.
- It skipped any account worth less than $10 (a fallback that remote settings could change). In Polymarket's June incident, the threshold was $100,000.
- For Magic email accounts it sold every open position, first at 3% under market, then at half price, then at whatever the book would take, and swept the collateral. For external wallets it transferred the position tokens directly.
- It submitted signed batch instructions through Polymarket's own relayer, so the withdrawals passed the deposit wallets' normal approval checks and Polymarket even paid the gas.
- It converted proceeds into POL rather than holding stablecoins, because USDC can be frozen by its issuer and POL cannot.
- It reported every hit back home, wallet, country, portfolio size and success, through DebugBear's own data endpoints, which nobody would think to block.
No routine in the script exports passwords, seed phrases or private keys. It did not need them. A script running inside a trading page can reach everything the page can reach, and calling it "analytics" does not give it a separate security boundary.
Minute by minute
Sources: on-chain tracking published on X by StarPlatinum, Andrew 10 GWEI and Bubblemaps; Bitquery; Polymarket status page and official posts; DebugBear's post.
Why every headline has a different number
Address counts are not user counts: one person can own several wallets. Polymarket has not published its own loss figure.
The spread is normal for a live incident. The useful figure is the median: Bitquery puts it at $171 per account. This was a wide, shallow drain that hit ordinary traders, the opposite of June's attack, which took about $3.1M from just 11 large wallets.
The "$800K victim" who was not a victim
The first viral post claimed a well-known trader lost $800,000. Bubblemaps and other on-chain analysts showed his outflow did not match the drainer's pattern at all: the money went to one of his own previously used wallets, and the post carried his referral link. When you read live hack coverage, check whether the "victim" wallet behaves like the other victims before you share it.
Third time this year
Polymarket has now lost money through its web layer three times in 2026: roughly $700K in May, about $3.1M in June through a hacked third-party script, and this one. It reimbursed users each time. None of the three touched its smart contracts. We covered how Polymarket's markets and order flow work in our earlier piece on building a Polymarket trading bot, and the uncomfortable takeaway from that build holds here too: the on-chain part is the most robust piece of the stack.
How the Binance hack happened: one laptop, 50 signatures, 24 seconds
About three hours after Polymarket came back online, an on-chain watcher flagged a "possibly massive Binance hack": an entire hot wallet emptied into a brand new address in one transaction, funded through Tornado Cash. Binance stayed silent for most of an hour while Tether and Circle froze funds. By the next morning it had confirmed the hack, named a compromised DevOps engineer's laptop as the entry point, and put the estimated impact at about $6.3 billion.
What EIP-7702 has to do with it
EIP-7702, shipped in Ethereum's Pectra upgrade, lets a normal wallet temporarily run smart contract code. The owner signs an authorization saying "my account now delegates to this contract", and that authorization only works at one specific nonce, the wallet's transaction counter.
That detail is what makes this attack so specific. Binance 14 was a busy hot wallet, so its nonce kept moving. According to Blockaid's analysis of the drain transaction, the attacker did not know which nonce would be live at the moment of inclusion, so they brought 50 authorizations with consecutive nonces and sprayed them all in a single type-4 transaction. One matched. That one installed a sweeper contract that only the attacker's relayer could operate, and the next call drained the wallet.
Only Binance's key, or the system that holds it, can produce those signatures. Binance says it found no evidence of a key leak, which fits: the attacker did not steal the key, they got Binance's own signing service to sign for them from inside a service container. The analyst Quit made the same point within hours: if the attacker had the raw keys, they would not have needed a relayer or 50 guesses.
The full timeline
Sources: Binance's official posts and announcement, Blockaid, TRM Labs, Tether, Circle, Arbitrum, and on-chain analysis published on X by inno, Quit and International Cyber Digest. Developing story; times are when each event was first visible publicly.
The freeze race, and the move that beat it
The fastest defenders on October 29 were not Binance. Tether's Paolo Ardoino announced more than 1.567B USDT frozen, Circle's Jeremy Allaire about 800M USDC, then Ripple froze RLUSD, World Liberty froze $27M of USD1, Aave froze markets, Arbitrum's Security Council seized about $30.5M, and Coinbase blocked sends to the attacker's wallets.
The attacker had planned for this. Before the blacklists landed, they deposited about $60M USDT into Aave and borrowed roughly 19,762 ETH against it. The USDT was later frozen inside Aave; the ETH was already gone. Stablecoins have an off switch, ETH and BTC do not, and the bulk of the unrecovered $3.3B is exactly those assets. Elon Musk summed up the mood in three words: "Everyday is Zeroday."
Who is behind the Binance hack
TRM Labs attributes the theft to TraderTraitor, the North Korean state-sponsored group, and says the playbook mirrors the February 2025 Bybit hack, which was also a compromised developer machine followed by a manipulated signing flow. Bybit lost about $1.5B. This is roughly four times that. Binance has not named an attacker.
What we still do not know
- How the laptop was compromised: phishing, a poisoned dependency, a malicious browser extension or something else.
- Why a service container could request signatures for a delegation to an unknown contract, 50 times, without a human or a policy engine stopping it.
- Why the authorizations were usable about two days after the setup began, and whether other hot wallets had pending authorizations too.
- The final unrecovered total. Binance says it will publish a post-mortem and an updated Proof of Reserves once remediation is complete.
Is this the biggest crypto hack ever?
Yes, by a wide margin. Even counting only the roughly $3.3B that was not frozen, the Binance hack is more than twice the size of the previous record, Bybit in February 2025. The pattern across the list matters more than the ranking: the biggest thefts in crypto history keep coming from people and signing systems, not from broken code.
Amounts in US dollars at the time of each theft. All of the top three were operational compromises of people and signing systems, not code bugs. Bybit, Ronin and Binance are attributed to North Korean groups.
What both hacks have in common (our read)
We build and audit production systems for a living, including payment flows, trading tools and the AI-assisted codebases most startups now ship. Read side by side, these two incidents say the same three things.
1. The money moved through the front door. Polymarket's withdrawals went through Polymarket's relayer. Binance's went through Binance's signer. Every control that checks "is this a valid request from our own system?" said yes, because it was. Security that only checks validity, not intent, is a lock that opens for anyone holding the right uniform.
2. The weakest component was the most boring one. A page-speed widget. An engineer's laptop. Neither appears on a threat model slide next to "smart contract audit", and both had a direct path to customer money. The OpenAI breach through an image decoder we broke down in September followed the same shape: the entry point was a dependency nobody chose on purpose.
3. Speed now favours the attacker. Twenty minutes for $6B, one hour for $2.7M, and in both cases the public saw it on X before the company said a word. AI-assisted tooling makes reconnaissance and exploit building cheaper every quarter, which is why we keep writing about putting AI on the defensive side too. Detection measured in hours is now detection after the fact.
Your app has the same two holes
You do not need billions in a hot wallet to be exposed. Any product with a login, a payment form or an admin panel loads third-party JavaScript next to its users' sessions, and has at least one laptop with a path to production. AI-built apps are the most exposed: tools like Cursor, Lovable and Bolt paste analytics, chat and tracking snippets wherever they are asked, rarely add integrity checks, and nobody reviews which of them run on the checkout page. Six questions worth answering this week:
The single cheapest fix is the boring one. Add an integrity hash to every third-party script tag, and move anything you cannot pin off the pages where money or credentials live.
Built your app with AI? Find these holes before an attacker does
Both October 29 hacks came through components nobody was watching: a script tag and a laptop with too much reach. AI-generated codebases are full of exactly those: unpinned third-party scripts, secrets in the wrong place, sessions that can do anything, and no alert when something does.
Our Vibe Coding Cleanup starts with a fixed-price audit from $199. A senior engineer reviews your repo across security, architecture and deployment, gives you a production-readiness score and a ranked risk map, worst first, then quotes a fixed-price cleanup if you want us to fix it.
FAQ
Was Binance hacked?
Yes. Binance confirmed on October 30, 2026 that an attacker used a compromised DevOps engineer's laptop to reach a service container and submit unauthorized withdrawal transactions from its hot wallets. The exchange estimates the impact at about $6.3 billion, with roughly $3 billion frozen on-chain, and says it will cover all losses.
How much was stolen in the Binance hack?
Binance's own estimate is about $6.3 billion in impact. TRM Labs puts it at $6.36 billion across 10 blockchains. About $3 billion was frozen by Tether, Circle, Ripple, Arbitrum and others within hours, so the unrecovered amount is roughly $3.3 billion. Either way it is the largest crypto theft on record, about four times the February 2025 Bybit hack.
Are Binance user funds safe?
Binance says user balances are unaffected because it will cover the loss from its SAFU fund and company funds, and it has promised an updated Proof of Reserves. Deposits resumed on October 30; withdrawals were paused with an expected restart within 48 hours. Rely only on official Binance channels for updates, because fake support accounts multiply during incidents like this.
How did the Polymarket hack work?
Polymarket's international site loaded a real-user monitoring script from DebugBear, a page-speed vendor. That script was replaced with a drainer at the same address. Running inside polymarket.com, it found each visitor's live trading session and wallet signer, sold or transferred their positions through Polymarket's own relayer, swapped the proceeds to POL and sent them to the attacker. About $2.7 million was taken from roughly 700 accounts in an hour.
Was either hack a smart contract bug?
No. No smart contract was exploited in either incident. Polymarket was drained through code running in its own website, and Binance through its own signing pipeline producing valid EIP-7702 authorizations. In both cases the cryptography worked; the trust around it did not.
What is EIP-7702?
EIP-7702 is an Ethereum change shipped in the Pectra upgrade that lets an ordinary wallet temporarily run smart contract code. The wallet owner signs an authorization pointing at a contract, and that authorization is valid for one specific nonce. The Binance attacker held 50 such signed authorizations with consecutive nonces, sent them all at once, and the one that matched installed a sweeper contract on the hot wallet.
Who is behind the Binance hack?
TRM Labs attributes it to TraderTraitor, a North Korean state-sponsored group, and says the operation resembles the 2025 Bybit theft. Binance has not named an attacker yet and says it is working with law enforcement on attribution.
What is the biggest crypto hack in history?
The October 29, 2026 Binance hack, at an estimated $6.3 billion in impact, is the largest crypto theft on record. The previous record was the February 2025 Bybit hack at about $1.5 billion, followed by Ronin Network at about $625 million in 2022.
Is Polymarket safe to use now?
Polymarket says it removed the compromised third-party script and the platform has been trading normally since about 19:00 UTC on October 29. The drainer used existing logged-in sessions, so affected users should still review recent activity, revoke unfamiliar approvals with a tool such as Revoke.cash, and contact Polymarket support only through official channels.
What is a supply chain attack?
A supply chain attack compromises a vendor, library or tool that a target already trusts, instead of attacking the target directly. In the Polymarket case the attacker compromised a performance-monitoring script from DebugBear, and every visitor's browser ran the malicious version as if Polymarket had written it.
Will Polymarket users get their money back?
Polymarket says everyone affected will be made whole. Some users report that the reimbursement process asks for identity verification and a broad non-disparagement agreement; Polymarket has not publicly commented on those terms.