Binance and Polymarket were hacked on the same evening. What we know

1.1

Minute by minute

All times are UTC. The first Binance transfer came at 4:24 pm in New York, 8:24 pm in London and 4:24 am on Friday in Singapore.

• Binance
• freezes
• market

1. Thursday, 29 October
2. 20:15

   MarketThe last prices before the hack: bitcoin $80,327, ether $2,313, BNB $738.90.

3. 20:21

   BinanceA new-style transaction carrying fifty signed authorisations for the wallet Binance 14 hits the chain. One of them works, and the wallet starts running someone else’s contract code. The sender got its gas money through the Tornado Cash mixer.

4. 20:24

   BinanceA single transfer moves 167,464 ETH, about 1.6 billion USDT and 62 other tokens out of Binance 14.

5. ≈20:27

   BinanceThe attacker pledges 60 million USDT on Aave and borrows 19,762 WETH against it (about $45 million) — ether nobody can freeze.

6. 20:39

   BinanceAnother 195,460 ETH (about $440 million) moves to a different address.

7. 20:41

   Binance780 million USDC leaves a second, linked address.

8. 20:50

   MarketBNB hits its low for the evening: $692.32, 6.3% below its pre-hack price.

9. 21:00

   MarketBitcoin: $78,763.

10. 21:04

    Circle823 million USDC frozen on the main receiving address.

11. 21:15

    BinanceBinance founder Changpeng Zhao (CZ): “User funds are safe!” and “It does look like a hack on Binance.”

12. 21:22

    BinanceThe attacker starts dumping what Tether and Circle cannot freeze, beginning with 88.5 million RLUSD.

13. 21:24

    BinanceThe exchange’s first statement: its teams are “aware of reports of a potential security issue” and investigating, with no confirmed impact on user funds. The text is edited twice within 13 minutes.

14. 21:25

    TetherCEO Paolo Ardoino: more than 1.567 billion USDT frozen.

15. 22:15

    BinanceThe exchange halts withdrawals.

16. 22:32

    AaveThe protocol says it has frozen its V3 and V4 markets, so stolen funds can no longer be pledged or borrowed against. Users can still withdraw their own money.

17. 22:34

    BinanceOver seven minutes the attacker’s address sends out 2.57 million LINK (about $28 million), 127,953 AAVE (about $16 million) and 167 WBTC (about $13 million).

18. 22:36

    WLFWorld Liberty Financial freezes $27 million in USD1 and $2 million in WLFI.

19. 23:22

    BinanceThe verified frozen total stands at $2.54 billion. Figures circulating online, including $1.8 billion, differ from the verified ones, the exchange says.

20. 23:40

    RippleThe company freezes RLUSD linked to the hack.

21. Friday, 30 October
22. 00:00

    MarketBitcoin: $77,771.

23. 00:04

    BinanceCo-founder Yi He: user funds are safe and Binance will cover all losses from the hack. Deposits are now suspended too.

24. 00:07

    MarketMarket makers disclose their exposure: under 20% of net equity at Wintermute, under 5% at GSR.

25. 00:26

    BinanceChainalysis puts the theft at $5.912 billion. Blockaid’s CEO: “We don’t think a key was leaked.”

26. 00:52

    BinanceAbout $3 billion frozen. Arbitrum’s Security Council locks up another $30.5 million.

27. 01:14

    BinanceAnother 2,000 ETH reaches the attacker’s main address, which now holds about 197,460 ETH, roughly $436 million.

28. 01:20

    BinanceBinance 14 has no foreign code any more: the authorisation has been revoked.

29. 01:25

    ZachXBTThe independent investigator counts more than $2.83 billion frozen.

30. 02:07

    MarketBitcoin $76,418, 4.9% below its 20:15 level. Ether $2,182, BNB $700.

1.2

How one signature opened a hot wallet

Every exchange keeps two kinds of wallets. Cold wallets hold most of the money and rarely touch the network. Hot wallets run around the clock: customer withdrawals go out of them automatically, so a machine has to sign for them. Binance 14 is one of Binance’s hot wallets on Ethereum. It is also on the list of addresses the exchange uses to prove that it holds its customers’ assets one for one.

What EIP-7702 is

In May 2025 Ethereum shipped the Pectra upgrade, and with it a feature called EIP-7702. It lets an ordinary wallet “put on” a smart contract’s code: the owner signs an authorisation, and from then on the address runs that code. It is handy — you can bundle ten transfers into one transaction, say, or pay fees in something other than ether.

But sign such an authorisation for an attacker’s contract and the attacker owns the wallet outright. No further signatures needed: the authorisation stands until it is revoked.

The delegation persists; that code can authorize later transfers without another signature from the wallet.

Odysseas Lamtzidis, founder of Phylax Systems, as quoted by Decrypt

How it went

1. Gas money from a mixer. The attacker’s address received 0.1 ETH through Tornado Cash — plenty to pay the fees.
2. Fifty authorisations in one transaction. At 20:21 a transaction of the new type 4 went out carrying fifty signed authorisations for Binance 14. All pointed at the same contract, each with a different sequence number (nonce). It looks as if the attacker didn’t know the wallet’s current number and tried fifty in a row. One matched.
3. The wallet became a vacuum cleaner. Binance 14 began running an unverified sweeper contract that let a designated operator empty it of every token and all its ether.
4. Three minutes, two billion. At 20:24 a single transfer took 167,464 ETH, about 1.6 billion USDT and 62 other tokens. Then came 195,460 ETH and 780 million USDC from a neighbouring address. On Ethereum alone, about $2.8 billion.
5. Ditch the freezable first. Almost at once 60 million USDT went into Aave as collateral, and the attacker borrowed 19,762 WETH against it. The rest was scattered over dozens of addresses and swapped into things no issuer can stop.
6. The door was shut five hours later. By 01:20 Binance 14 had no foreign code left: the authorisation had been revoked.

The big question: where did the signature come from

An EIP-7702 authorisation only works if the wallet’s own key signed it. So the attacker had a Binance 14 signature. How they got it is unknown — and almost everything else depends on the answer.

There are three possibilities: the key itself was stolen; the internal system that signs transfers was hacked or tricked; or someone on the inside helped. Blockaid’s CEO Ido Ben-Natan leans towards the second.

It seems to be… a compromise of signing infrastructure. We don’t think a key was leaked.

Ido Ben-Natan, Blockaid, as quoted by Cointelegraph

He calls the attack “very, very similar” to the Bybit hack of February 2025. Back then the attackers compromised a developer at the wallet provider Safe, used that to tamper with the interface Bybit signed its transfers in, and the signers approved the malicious transaction themselves. Ben-Natan thinks this operation, too, may have involved several compromised devices and movement through the exchange’s internal network, but stresses that none of it is verified.

Arkham’s CEO Miguel Morel is more cautious: there is not yet enough data to tell a stolen key from broken infrastructure. Binance itself has not named a cause and promises a full post-mortem once the investigation ends.

What about Bitcoin and Tron

According to a count cited by Decrypt, money left not only on Ethereum ($3.51 billion) but also on Bitcoin (18,270 BTC, about $1.44 billion) and Tron ($630 million). EIP-7702 exists only on Ethereum and chains like it, so it does not explain those outflows. Whether they were the attacker’s moves or Binance hurriedly shifting its own funds is not fully settled. Molly White of Citation Needed first doubted the bitcoins were stolen, then, after another researcher’s input, grew less sure those wallets were unrelated to the hack.

Who is behind it

ZachXBT and Blockaid think North Korea is the likely culprit: the on-chain preparation looks too much like its hackers’ past operations. That is an assessment, not an established fact. In the Bybit case the FBI formally named North Korea five days after the theft. The FBI and the US Justice Department have not answered AFP’s questions about Binance.

1.3

The freezes: where the money got stuck

The night’s one piece of good news: nearly half of the loot was stopped within hours. That was possible because most of it was in stablecoins — tokens pegged to the dollar. Each has an issuing company behind it, and the issuer can blacklist an address so the tokens on it simply stop moving. Circle did so 40 minutes after the first transfer; Tether announced its freeze an hour in.

Frozen is not the same as returned. Usually the issuer burns the blocked tokens and mints new ones for the rightful owner, but only after a court order or a police request. That takes weeks. For now a freeze only shrinks the sum Binance has to cover out of its own pocket.

None of this works for ether or bitcoin: there is no issuer and no stop button. So the attacker’s first priority was to turn stablecoins into something unfreezable. Hence the Aave loan: against collateral that was about to be frozen, they managed to get real ether out. The position is still sitting there: $59.9 million of collateral against $43.8 million of debt. If ether rises about 4%, to around $2,365, it gets liquidated.

1.4

How much was really taken

The honest answer: nobody knows for sure yet. The estimates differ by a factor of two.

Why they differ so much:

• Which chains count. $2.8 billion is what provably left Binance 14 and a linked address on Ethereum. The biggest estimates add Bitcoin and Tron, where the mechanism itself is unclear.
• Whether frozen funds count. Arkham, for one, includes everything sitting on the attacker’s addresses — even what they can no longer touch.
• At what prices. Dozens of small tokens cannot be sold at their market price: start dumping them and the price collapses.
• Whose addresses they are. Some wallets are tied to the attacker by circumstantial evidence, and analysts’ lists differ.

Take the widest estimate and subtract the freezes, and the attacker is left with something like $2.5–3 billion, mostly in ether and bitcoin. Count only what is proven on Ethereum and it is about $600 million: roughly 197,000 ETH, the ether borrowed on Aave and a little over $120 million in smaller tokens.

CZ answered someone’s estimate of a $1 billion net loss in a single line: “Loss might be a bit higher than that, but will cover.”

Even the low estimate is nearly twice the size of Bybit, the previous record. The high one is four times it.

1.5

The market: five per cent down and $628 million liquidated

No panic, but a nervous night. Bitcoin lost about 5% and ether nearly 6%. The exchange’s own token, BNB, took the hardest hit.

The low is the lowest of the price snapshots in CryptoTicker’s log, not the exact bottom. Over 24 hours BNB was down almost 10%, according to AFP.

In one hour $628 million of leveraged positions were force-closed, $607 million of them bets on prices going up. More than half of those liquidations happened on Binance itself. The whole market’s capitalisation slipped to $2.65 trillion and the Fear & Greed Index fell to 30, “fear”, its lowest reading since 14 August.

What went up is more telling. The token of the decentralised exchange Hyperliquid gained about 15%, Tron’s token 5 to 9% and the privacy coin Monero about 6%. Tokens of the protocols the attacker pushed stolen funds through fell harder than the market too: AAVE and UNI lost about 11%.

Market makers felt it directly. Wintermute said its exposure to Binance is under 20% of its equity, GSR under 5%. Wintermute’s chief executive Evgeny Gaevoy still reckons Binance could take a hit three or four times as large.

1.6

What we know, and what nobody knows

1.7

What to do if you have money on Binance

Withdrawals are closed for everyone, so there is nothing to do right now — which is itself a reason not to panic. The real danger over the next few days is scammers. Emails and messages about “refunds”, “account verification” or an “urgent move to a safe wallet” are almost certainly fake. Check news only in the official app and on the exchange’s own accounts. Binance warned about exactly this in its very first statement.

2.1

Minute by minute

All times are UTC. The first transfer to the attacker came at 1:10 pm in New York and 5:10 pm in London.

• Polymarket
• background

1. Tuesday, 27 October
2. 12:50

   DebugBearA file on the service’s CDN is updated; the drainer will later be found in it. The time is the Last-Modified header, so the real swap may have come later.

3. —

   Predict.funAnother prediction market reports about 400,000 USDT stolen through a compromised documentation site. No link to Polymarket has been shown.

4. Thursday, 29 October
5. 17:10

   PolymarketThe first transfer, 1,957 POL, lands in the attacker’s wallet 0x3F99…fc18. The tampered script is already live on the site.

6. 17:26

   PolymarketThe first batch of “outcome tokens” — other people’s bets — arrives.

7. 17:46

   PolymarketA trader posts that $800,000 has been drained from their account and all their positions sold.

8. 17:59

   PolymarketA new build of the site goes out — without the DebugBear script.

9. 18:01

   DebugBear“We’re impacted by an ongoing security incident.” Every customer of its real-user monitoring product is told to remove the embed code from their site.

10. 18:03

    PolymarketThe last incoming transfer. The attacker’s wallet holds about 28.5 million POL.

11. 18:05

    PolymarketThe exchange switches to cancel-only mode and the transaction relayer is paused.

12. 18:37

    PolymarketThe cause has been found and fixed; trading is halted as a precaution.

13. 19:05

    PolymarketTrading resumes.

2.2

The script that traded for its users

A bet on Polymarket is an “outcome token” — a “yes”, say, on something happening. Call it right and each token turns into a dollar. Like any big website, Polymarket runs other companies’ scripts on its pages. One of them, from DebugBear, simply timed how fast the site loaded for real visitors. On 29 October it took up a different line of work.

Researchers at Hudson Rock and DeFi Prime saved the malicious version and took it apart. This is how it worked.

1. Swapped at the source. The file cdn.debugbear.com/C7xcKKrjUnXK.js was served by DebugBear’s own servers, and the script reported back to DebugBear domains too. From the outside it looked like ordinary telemetry.
2. It read what the site keeps in the browser. How the person had logged in (by email or with their own wallet), their Polymarket wallet address and the trading-API credentials for the current session.
3. It found the page’s own trading engine. The site is built with React. The script walked up to 400 page elements until it reached the live exchange client — the object that knows how to place orders.
4. It sized up the victim. Positions and balances came from Polymarket’s public API. Anything from $10 up was worth taking.
5. Then it all came down to the login. For email users, the embedded Magic wallet signs by itself, with no pop-up, so the script simply sold all their positions at market. Users with their own wallet, such as MetaMask, saw a signature request: a batch transfer of their bets to the attacker, sent through Polymarket’s gas-paying relayer.
6. Idle cash went the same way. Any pUSD in the account was swapped into the POL token and sent to the attacker.

2.3

How much was taken, and how Polymarket responded

By 18:20 the attacker’s wallet held 28,636,284 POL — about $2.64 million. BleepingComputer later saw it split across three more wallets. Bubblemaps counted around 700 victims and roughly $2.7 million; analysts cited by CNBC put it at no less than $2.7 million from 710 wallets. The largest known loss is $800,000, according to the trader who lost it. Polymarket has not published a total.

Trading stopped 55 minutes after the first transfer and was back an hour later. “One of our third party providers was compromised,” Polymarket said. It promised that “anyone who has been impacted will be made whole” and referred the case to UK law enforcement. Polymarket US, a separate exchange regulated by the CFTC, was not affected.

This is Polymarket’s third incident in six months. In May about $600,000 was taken from a long-forgotten operational wallet through a leaked key. In June a compromised supplier had already injected a malicious script into the site; losses were put at close to $3 million, and the company promised full repayment then too.

2.4

Why this is possible at all

A browser does not wall off the scripts on one page from each other. Analytics, ads or monitoring code gets exactly the same powers as the site’s own code: it sees the session and can press the buttons.

A Content Security Policy would not have helped here: DebugBear’s domain was already on the allow list. Pinning the file’s hash (Subresource Integrity) or hosting a copy on your own server would have — the tampered file would simply never have run. But such locks get in the way of a vendor’s updates, and many sites do without.

2.5

What we know, and what to do

If you trade on Polymarket

Check your trade history and balance. Get news about repayment only from Polymarket’s official channels. And if a tab with the site has been open since Thursday, reload it: the fix does not reach a page that has already loaded.

If you build websites

Every third-party script runs with your site’s powers. On pages where users sign for money, it is best to have no foreign code at all. Where you can’t avoid it, host a copy yourself or pin the file’s hash (Subresource Integrity), and put big actions like selling an entire portfolio behind a separate confirmation step.