Two hacks in one day: what happened at Binance and Polymarket
On Thursday, 29 October 2026, two of the best-known names in crypto were hacked within hours of each other. Binance, the largest exchange, lost an estimated $6.3 billion, the biggest theft crypto has seen. Polymarket, the prediction market, lost about $2.5 million from its users' wallets.
How they were hit matters well beyond crypto. One attack came in through an engineer's laptop, the other through a vendor's script.
The figures below come from the companies and from on-chain investigators as of 30 October; both investigations are still open.
What happened at Binance
Binance's initial investigation suggests the incident "may involve a compromised DevOps engineer's laptop", which let an attacker reach a service container and submit withdrawal transactions. The exchange said it found "no evidence of any wallet private key leak". In other words, nobody cracked the vault. Binance's own systems sent the money out, because the requests came from a place they trusted.
The attack was prepared in advance. According to TRM Labs, the attacker funded a wallet the day before, tested the code on two wallets early on the 29th and rehearsed it on a third. The theft itself was quick: most of the money left hot wallets on ten blockchains in about twenty minutes. TRM attributes it to TraderTraitor, the North Korean group the FBI linked to the $1.5 billion Bybit hack in 2025.
Binance suspended deposits and withdrawals. With Tether, Circle and others it froze about $3 billion of the stolen assets, and it says it will cover the losses from its own funds and its SAFU reserve, which CoinDesk puts at roughly $1 billion in bitcoin.
What happened at Polymarket
Polymarket's website loaded a performance-monitoring script from a vendor, DebugBear. On 29 October that script, served from DebugBear's own servers, started delivering code that drained wallets. BleepingComputer describes what it did: it checked whether the visitor was logged in, then used their trading session to sell their positions or send their tokens to the attacker.
Polymarket removed the script, put the exchange in cancel-only mode and had trading back the same afternoon. "One of our third party providers was compromised," it said, adding that anyone affected "will be made whole". On-chain analysts count hundreds of affected wallets.
It was the second time this year. In June, according to Halborn, a compromised vendor got malicious code onto Polymarket's site and about $3 million was taken.
What the two attacks have in common
In neither attack did anyone break the core system. Binance's withdrawal service did what a trusted container asked. Polymarket's exchange accepted trades from real, logged-in sessions. Everything looked legitimate until the money was gone.
Both were also fast. Most of Binance's losses left in about twenty minutes, and the draining at Polymarket took a few minutes. By the time anyone could react, the damage was done.
Why backups are a must-have anyway
In neither attack would a backup have helped: stolen crypto doesn't come back from a copy. But breaches keep getting bigger. Chainalysis counted more than $3.4 billion stolen in crypto across all of 2025. Binance lost nearly twice that in a single day, and the previous record, Bybit's $1.5 billion, stood for less than two years. Outside crypto, a third party was involved in 48% of breaches in Verizon's 2026 Data Breach Investigations Report, up from 30% a year earlier.
A developer's laptop and a vendor's code are ways into any company, and the next attack may delete or overwrite data instead of stealing money. Then what decides the outcome is a copy made before the incident and kept somewhere else. Binance can pay its users back because it kept a reserve outside the wallets that were drained. A backup is that reserve for your data, and as breaches grow, it's no longer optional.
Facts about both incidents checked on 30 October 2026.