TL;DR
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Blockchain investigators reported that about $6.36 billion moved from wallets associated with Binance on October 29, in a possible record-setting crypto theft. Binance says the assets came from company-controlled holdings and that customer funds remain safe, but the attack’s full mechanics, attribution and unrecovered amount are not confirmed. A separate Polymarket breach was reported the same day.
Blockchain investigators reported that about $6.36 billion in cryptocurrency moved from wallets associated with Binance on October 29, in a possible record-setting theft that has raised questions about the security of centralized exchanges. Binance said the assets came from company-controlled holdings and that customer funds remain safe; the exchange suspended deposits and withdrawals while investigating.
According to blockchain intelligence firm TRM Labs, the transfers crossed ten blockchains, with much of the activity occurring in about 20 minutes. The reported amount would exceed the approximately $1.5 billion Bybit theft in February 2025, previously described in the source material as the largest cryptocurrency theft. The comparison depends on the estimated value of the assets and the status of ongoing investigations.
Binance’s preliminary investigation reportedly found that attackers may have compromised a laptop used by a DevOps engineer, then gained access to internal services that could submit withdrawal transactions accepted as legitimate. The company has identified other possible points of compromise and has not established the full sequence of events. Binance said it would cover the losses with corporate reserves and other available resources.
Investigators and cryptocurrency issuers have reportedly frozen about $3 billion in assets, but the source material says billions remain unrecovered. Binance halted deposits and withdrawals during the investigation, limiting customers’ ability to move funds even as the company said customer holdings were not the source of the stolen assets. Separately, Polymarket temporarily restricted international trading after a third-party software provider was reportedly compromised; investigators estimated that about $2.7 million was taken from more than 700 accounts.
Digital Assets · Incident Briefing
What The $6.3 Billion Crypto Theft Could Mean For The History Of Heists
Investigators reported an extraordinary wave of transfers from Binance-associated wallets. The scale could reset the record for crypto thefts, while key details about the attack and losses remain under investigation.
A new record, if confirmed
Comparisons depend on asset valuation and what investigators ultimately classify as stolen.
Binance-linked transfers
$6.36BReported October 29. The estimate would be substantially larger than previous crypto theft records if confirmed as a theft of that value.
Bybit breach
~$1.5BThe February 2025 incident was described in the source material as the previous largest cryptocurrency theft.
Access is part of the risk
A public blockchain can work as designed while the systems controlling access to funds are compromised.
Binance’s preliminary account points to a possible compromise of a DevOps engineer’s laptop and internal services used to submit withdrawal transactions. The full sequence, entry point, and duration of access have not been established.
Withdrawal authority
Attackers may have gained access to services able to submit transactions that appeared legitimate to the platform.
Funds can be hard to reach
Binance suspended deposits and withdrawals during its investigation. A displayed balance and immediate ability to move funds are different things.
A second route in
Polymarket reported a separate breach tied to a third-party software provider and active user sessions.
What is known so far
Company statements and investigator assessments remain preliminary; new findings may change this picture.
Transfers reported
Investigators tracked about $6.36 billion moving from Binance-associated wallets.
Platform response
Binance halted deposits and withdrawals while examining the incident.
Tracing and freezes
About $3 billion in assets was reportedly frozen; the recoverable total is uncertain.
Open investigation
The attack path, final loss and attribution have not been independently established.
Claims are not conclusions
Investigators have offered a possible attribution, while Binance’s investigation continues.
Suspected actor
TRM Labs and Chainalysis reportedly linked the activity to TraderTraitor, an operation associated with North Korea. This remains an investigator assessment; Binance had not formally confirmed responsibility in the supplied material.
Recovery remains unclear
Investigators and cryptocurrency issuers reportedly froze about $3 billion. Billions may remain unrecovered, and the source material does not establish how much can ultimately be returned.
Two incidents, different exposures
One account centers on exchange infrastructure; the other on an outside provider.
“Approximately $6.36 billion was moved across ten different blockchains.”
“The vulnerability has been addressed, and affected customers will be reimbursed.”
What the next findings need to answer
Was $6.36 billion confirmed stolen?
No. It is a reported transfer estimate from Binance-associated wallets. The full amount is not confirmed as a final loss.
Did Binance say customers lost funds?
Binance said the assets were company-controlled and customer funds remained safe. The supplied material offers no independent verification.
Who carried out the attack?
TRM Labs and Chainalysis reportedly attributed it to TraderTraitor. Responsibility remains unconfirmed by Binance in the supplied material.
When will normal access return?
The source material gives no timetable for restoring deposits and withdrawals. Polymarket also gave no reimbursement schedule.
Why Exchange Controls Matter
The reported scale makes the incident consequential even if the final loss estimate changes. A theft of this size could surpass prior crypto exchange breaches and intensify scrutiny of how platforms protect the systems that authorize withdrawals. For customers, the event also highlights that an account balance and immediate access to funds are not the same thing: when a platform suspends withdrawals, users may be unable to move assets while the company investigates.
The available account points to a possible compromise of centralized infrastructure, not a failure of the underlying blockchain networks. That distinction matters: public blockchains can record transfers while an exchange’s internal devices, credentials or services are compromised. The Polymarket incident, involving a reported third-party software weakness and active user sessions, illustrates a different route into a financial platform. Taken together, the incidents draw attention to risks in both direct exchange operations and outside vendors.
The reported frozen funds may aid recovery, but the source material does not establish how much can ultimately be returned. Nor does it provide independent confirmation of Binance’s assurance that customer funds are safe. The practical consequences for users will depend on the exchange’s investigation, the restoration of normal withdrawals and whether any customer balances or services were affected beyond the reported company holdings.
Products Worth Considering
Ledger Flex + Folio Crypto Hardware Wallet
Trezor Safe 5 Crypto Hardware Wallet with Color Touchscreen, Black Graphite
Logitech MX Mechanical Full-Size Wireless Mechanical Keyboard, Tactile Quiet Switches, Backlit Keys, Bluetooth, USB-C, Multi-Device, Graphit
As an affiliate, we earn on qualifying purchases.
Earlier Crypto Theft Comparisons
Large cryptocurrency thefts have often involved exchanges or other services that hold assets and manage access on behalf of users. The source material identifies the February 2025 Bybit breach, estimated at about $1.5 billion, as the prior record. The reported Binance-linked transfers would be substantially larger if the estimate and characterization as theft are confirmed.
TRM Labs and Chainalysis reportedly attributed the Binance attack to TraderTraitor, an operation associated with North Korea and linked by those firms to previous crypto thefts. Binance has not formally confirmed responsibility, and attribution remains an investigator assessment rather than an established finding. The source also describes the Polymarket incident as involving a compromised outside provider, but does not provide a complete technical account or specify the provider’s identity.
“Approximately $6.36 billion was moved across ten different blockchains.”
— TRM Labs
Key Questions Still Open
The reported $6.36 billion figure is an investigator estimate of transfers, and the source material does not clarify whether all of that value is confirmed stolen, how the valuation was calculated, or how much has been recovered. Binance’s investigation is preliminary; the exact entry point, duration of access and any other compromised systems remain unknown.
Responsibility also remains unconfirmed. TRM Labs and Chainalysis reportedly linked the incident to TraderTraitor, but Binance has not publicly confirmed that attribution in the supplied material. The degree to which customer accounts or services were affected beyond the temporary withdrawal suspension is also unclear. For Polymarket, the source does not identify the outside provider or explain the complete technical scope of the compromise.
Investigations and Access Restoration
Binance’s next steps are to complete its security investigation, clarify the attack path and determine the final amount of losses and recoveries. The exchange also needs to communicate when deposits and withdrawals can resume; the source material gives no timetable. Investigators and issuers may continue efforts to trace or freeze assets, though the amount ultimately recoverable is uncertain.
Polymarket said it had addressed the vulnerability and would reimburse affected customers, but the source does not give a payment schedule or further details about its review of the third-party provider. Both incidents remain developing stories, and reported estimates or attributions may change as companies and investigators publish additional findings.
Key Questions
Was $6.36 billion confirmed stolen from Binance?
No. TRM Labs reported about $6.36 billion in transfers from Binance-associated wallets. The source material does not confirm that the full amount represents a final loss, and the investigation is ongoing.
Did Binance say customers lost their funds?
Binance said the assets came from company-controlled holdings and that customer funds remain safe. The source material does not include independent verification of that assurance, and customers temporarily could not withdraw while services were suspended.
Who is suspected of carrying out the attack?
TRM Labs and Chainalysis reportedly attributed it to TraderTraitor, an operation associated with North Korea. Binance had not formally confirmed responsibility in the supplied material, so the attribution remains an investigator assessment.
How much of the reported stolen crypto has been frozen?
The source material says investigators and cryptocurrency issuers reportedly froze about $3 billion. It also says billions remain unrecovered, but does not give a confirmed final recovery total.
What happened at Polymarket on the same day?
Polymarket temporarily restricted international trading after a reported compromise involving a third-party software provider. Investigators estimated that about $2.7 million was taken from more than 700 accounts; the company said the vulnerability was addressed and affected users would be reimbursed.
Source: Off Grid Survival
