Binance's estimated $6.3 billion security breach may be the largest cryptocurrency theft on record.
A separate $2.7 million attack on Polymarket exposes a vulnerability with direct implications for digital marketing teams.
The two incidents are not known to be connected, but both show how attackers can exploit access to systems trusted by digital businesses.
The two companies then turned to X to update users, which put their crisis communications to a public test.
Binance said that an attacker's initial access may have come through a compromised DevOps engineer's laptop.
The attacker gained access to a service container and submitted unauthorized withdrawal transactions.
Binance has begun recovering affected assets for users and continues to work with law enforcement, issuers, blockchain intelligence firms and industry partners to trace, freeze and recover additional funds. The company has already publicly committed to cover losses through company funds in the prior announcement. Binance has already reserved over $6.34B of company funds to cover this incident. $5B of these funds are already held in the exact token assets that were impacted. We are completing the purchase of the remaining amount by buying token assets through market channels and OTC channels. We are doing this to match the format of the remaining token assets and address any asset shortfalls. This step can take longer because some tokens may have low liquidity and OTC settlement also takes time. We will share more progress as soon as we can. These figures do not include frozen or protected assets, which remain subject to ongoing recovery and verification. Currently, $3bn has been frozen, with thanks to our industry partners. We are working with partners and law enforcement to recover the frozen assets.We will continue to use company resources to cover confirmed shortfall and will provide further verified updates as recovery efforts progress. Ultimately, all user funds will be verified publicly through our Proof of Reserves. We will weather this storm. Thank you for the support.
— Binance (@binance) October 30, 2026
Further investigation uncovered additional breach points.
Blockchain intelligence firms TRM Labs and Chainalysis have attributed the attack to TraderTraitor, a North Korean-linked hacking group.
TRM estimates that approximately $6.36 billion moved from Binance wallets across 10 blockchains.
Most of the transfers happened within 20 minutes.
Binance said that industry partners have frozen about $3 billion in affected assets so far.
"We have found no evidence of any wallet private key leak," Binance said in its Oct. 30 security update.
The crypto exchange has more than 300 million registered users worldwide.
Its response will test whether its financial reserves and recovery measures can preserve customer confidence after a breach of this scale.
A compromised third-party website-monitoring provider reportedly exposed Polymarket users to malicious code through the platform's website.
The incidents expose two different weaknesses in digital infrastructure.
Attackers targeted the internal systems authorizing Binance withdrawals, while a third-party script was embedded in Polymarket's website.
Polymarket absorbs the reputational hit from its vendor's breach, since users hold the brand they logged into responsible.
Each company also promised to cover losses while its investigation is still running.
PR agencies prove their value in these first hours, when a client has to decide what it can promise before the facts are in.
A Site-Speed Script Became a Security Entry Point
DebugBear sells website performance monitoring tools to marketing teams, technical SEOs, and digital agencies.
Its SEO and marketing product monitors Core Web Vitals, page speed, and real-user experience.
BREAKING: $2.73 million was drained from 737 Polymarket accounts in 1 hour on 29th October 2026, according to Bitquery. The withdrawals passed the wallets’ approval checks and went through Polymarket’s own transaction service. The malicious code was found inside a tool meant to measure website speed. Hudson Rock found it in a script served by DebugBear, a monitoring provider used on Polymarket’s international site. The code searched for the user’s existing trading session and the software that could request wallet signatures. Depending on the account, it tried to sell bets or transfer the tokens representing them. It also attempted to submit signed instructions through Polymarket’s relayer, the service that sends transactions to the blockchain and pays network fees. Your wallet can verify a signature without knowing whether you understood or intended the transaction. A script loaded directly into a trading page can access other software and data inside that page. Calling it an analytics tool does not give it a separate security boundary. Hudson Rock found no routine in the inspected script that exported passwords, seed phrases or private keys. That does not establish how every approval was obtained, or whether users saw signing prompts. The code’s fallback settings skipped portfolios below $10. Remote settings could override that threshold. In June’s separate incident, Source Defense found a $100,000 threshold. AMLBot estimated that theft at $3.1 million across 11 wallets. October’s reported wallet count was 67 times June’s, for a similar total loss. These are estimates from different investigations. They do not establish a shared attacker. Bitquery puts October’s median account loss at $171. Polymarket says an outside provider was compromised and promises to reimburse affected users. It has not published its own loss total. The unresolved question is how the attacker obtained those valid approvals. The security problem is that code installed to measure page speed could reach the software used to move money.
— Shanaka Anslem Perera ⚡ (@shanaka86) October 30, 2026
Polymarket reportedly used DebugBear's Real User Monitoring (RUM) script on its website.
Security researchers found malicious JavaScript hosted on DebugBear's infrastructure.
The script targeted logged-in Polymarket users and attempted to liquidate positions and transfer assets to an attacker-controlled wallet.
WIRED reported that approximately 700 users appeared to have lost around $2.7 million.
Polymarket initially declined to confirm those figures but later put the count at 726 affected wallets.
Reuters identified DebugBear as the provider through a source familiar with the incident.
DebugBear acknowledged a security incident and told customers using its RUM product to remove the embedded code from their websites.
We are aware of a security incident affecting DebugBear and are treating it as a top priority. We have engaged specialist cyber incident response support and will work with affected customers directly. We will share further updates here as appropriate.
— DebugBear (@DebugBear) October 29, 2026
The attack targeted Polymarket specifically, but the weakness it exposed applies to any site that loads third-party scripts.
Website scripts can access browser activity and interact with authenticated sessions.
So, a compromised provider can create risks outside the performance data its customers expect to collect.
Binance faced a different form of infrastructure compromise.
Its findings so far suggest that attackers exploited systems with authority to authorize withdrawals.
Both incidents put third-party access and internal permissions under scrutiny.
Agencies that install monitoring or analytics scripts on client sites should audit which ones can run inside logged-in sessions.
Folding this kind of audit into client onboarding lets agencies offer data security as a standard part of every site build.
Crypto Theft Moves Up the Technology Stack
Binance's breach comes amid rising losses from attacks on cryptocurrency infrastructure.
TRM Labs counted $2.87 billion stolen across nearly 150 hacks in 2025, with the Bybit attack alone accounting for $1.46 billion, or 51%.
The FBI pinned the Bybit hack on TraderTraitor, which TRM now blames for the Binance breach as well.
TRM's report also found that attacks on keys, wallets, and access controls drove most of these losses.
Recovery leaned on the industry too, with Tether and Circle freezing more than $2.3 billion in stablecoins tied to the Binance theft.
The figures above point to three cybersecurity lessons for businesses managing digital infrastructure:
- Access controls determine the scale of exposure. Companies should audit third-party permissions and internal credentials to limit unauthorized access to critical systems.
- Operational security protects customer confidence. Companies should add approval steps and monitoring to any system that can move money or data.
- Recovery depends on a coordinated response. Businesses should establish relationships with partners to trace incidents and restore services quickly.
Agencies that map every vendor, login, and script touching client systems can offer cybersecurity reviews as a standing service.
Our Take: Why Do Brands Use Social Channels in a Crisis?
Social media gives companies a fast, public channel to address customers while an incident is still unfolding.
Binance used its account to share recovery figures, explain withdrawal restrictions, and direct customers to official updates.
Investigation update: Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach. This was a complex attack, and we are doing all we can in coordination with law enforcement to resolve it. We are still gathering the facts, and will share more directly as we have them. Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe. We are still on track towards the expected timeline to resume the withdrawal service in 45 hours. Deposits remain unaffected. The outflows ceased when we paused withdrawal service earlier. We are still working with partners to freeze many of the impacted assets, and have frozen around $3 billion thus far. We will continue to provide further updates through official Binance channels as more verified information becomes available.
— Binance (@binance) October 30, 2026
Polymarket announced its trading suspension, confirmed the platform had recovered, and promised full reimbursement.
The platform later reported refunding 689 of 726 affected wallets in full, with the remaining 37 paid as each one clears verification.
It also extended coverage to traders who lost money during the pause, sending $1.19 million to about 5,500 wallets.
Polymarket's total payout comes to roughly $3.9 million, and every refund goes out automatically.
Traders can check every figure in the post against their own wallets, which makes the update hard to dismiss.
DebugBear also used X to warn customers about its compromised RUM product.
The instruction to remove the embedded code gave clients an immediate action while the investigation continued.
PR teams drafting breach updates should push clients to publish counts and dollar amounts as soon as they're confirmed.
✅ 689 of 726 affected wallets have been refunded in full. The remaining 37 are being paid as each is verified. We're also going further. Traders who lost money during our trading pause, or whose positions were taken, are covered too: $1.19M to 5.5K wallets, starting today. In total, we’re returning $3.9M to traders: the $2.7M plus $1.19M to cover pause-related losses. No claims or tickets needed. The attack came through a compromised 3rd party provider which we removed within the hour. We are in active investigation with law enforcement & will share a postmortem.
— Polymarket Traders (@PolymarketTrade) October 30, 2026
We'd say that brands turn to social channels in a crisis because one post reaches customers, reporters, and partners within minutes.
This same post then becomes the official record everyone cites, which gives the brand a say in the story before rumors fill the gap.
But impersonators can flood a brand's feed, so the strongest crisis communications strategy backs social posts with direct support.
Brands face the same pressure to respond fast when a star's words put sponsors at risk, as Kylian Mbappé's China controversy showed for Real Madrid, LaLiga, and On.
Companies preparing for a security incident can work with these top crisis management firms to develop crisis communications plans.
