TL;DR
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Blockchain investigators reported that about $6.36 billion moved from wallets associated with Binance on Oct. 29, in a transfer sequence that could represent the largest cryptocurrency theft by reported value. Binance says the funds came from company-controlled holdings and customer funds remain safe; attribution and the full attack path have not been confirmed by the exchange. A separate Polymarket breach was also reported, with estimated losses of about $2.7 million.
Blockchain investigators reported that about $6.36 billion in cryptocurrency moved from wallets associated with Binance on Thursday, Oct. 29, in a transfer sequence that could make the incident the largest cryptocurrency theft by reported value. Binance says the assets were company-controlled holdings and that customer funds remain safe, but the exchange has not publicly confirmed who was responsible or fully explained how the transfers were enabled.
According to blockchain intelligence firm TRM Labs, the transfers crossed ten blockchains, with much of the activity taking place in roughly 20 minutes. The reported amount is far above the approximately $1.5 billion stolen in the February 2025 Bybit hack, which had previously been described as the largest cryptocurrency theft. The comparison is based on the reported value of the assets moved; the final losses and recoveries may change as investigators trace funds.
Binance’s preliminary investigation pointed to a possible compromise of a laptop used by a DevOps engineer. The source material says attackers may then have reached internal services that allowed withdrawal transactions to be submitted and accepted as legitimate. Binance has identified other possible points of compromise and says the sequence remains under investigation. It has suspended deposits and withdrawals while it assesses the incident and its systems.
The exchange says the funds came from company-controlled holdings, not customer accounts, and has pledged to cover losses with corporate reserves and other resources. Investigators and cryptocurrency issuers have reportedly frozen about $3 billion of the assets. That does not establish how much will ultimately be recovered: the reported value still unrecovered is substantial, and the available source material does not provide a final accounting.
Digital assets · Incident watch
Could The $6.3 Billion Cryptocurrency Theft Become History’s Largest Heist?
Investigators reported $6.36 billion moving from Binance-associated wallets across ten blockchains. Binance says the assets were company-controlled and customer funds remain safe; the full attack path, final losses and attribution are still unresolved.
01 / What is known
A record-sized movement, with open questions
The reported value far exceeds the approximately $1.5 billion stolen in the February 2025 Bybit hack. Whether this becomes the largest theft by final losses depends on what investigators confirm and what can be recovered.
Scale & speed
TRM Labs reported movement across ten blockchains, with much of it occurring in roughly 20 minutes on Thursday, Oct. 29.
Possible access path
Binance’s preliminary investigation pointed to a possible compromise of a DevOps engineer’s laptop and access to internal services. The entry point has not been confirmed.
Services paused
Binance suspended deposits and withdrawals while assessing the incident. It says the assets were company-controlled holdings and customer funds remain safe.
Reported value is not final loss. Investigators and issuers reportedly froze about $3 billion, but no final accounting of recoveries or unrecovered funds has been provided.
Keep the distinction clear02 / Two platforms, separate incidents
Different systems. Different exposure.
The incidents were reported on the same Thursday. Available information does not establish a connection between them.
Binance
Investigators reported $6.36 billion in transfers from associated wallets. Binance says customer funds are safe and has pledged to cover company-held losses with corporate reserves and other resources. Attribution and the final route of access remain unconfirmed by the exchange.
Polymarket
A separate issue reportedly involved an outside software provider. Researchers said malicious code may have used active sessions to make unauthorized transactions. More than 700 accounts were reportedly affected. Polymarket said the vulnerability was addressed and affected customers would be reimbursed.
“Approximately $6.36 billion was moved across ten different blockchains, with much of the activity occurring within roughly 20 minutes.”
— TRM Labs03 / What remains unconfirmed
Attribution and recovery are still open
The suspected employee-device compromise is preliminary. The full route, other affected systems and any additional access remain under investigation.
TRM Labs and Chainalysis reportedly linked the incident to TraderTraitor, associated with North Korea. Binance has not formally confirmed that assessment.
The reported transfer value does not settle net losses. A final accounting after freezes, recoveries and tracing has not been provided.
Binance says customer balances are safe. The supplied information includes no independent audit or detailed proof of reserves.
Customers may be unable to move assets while deposits and withdrawals are paused. A restoration timeline has not been specified.
The final loss total, full technical method and timing for reimbursing affected users remain unspecified in the available account.
04 / What happens next
From tracing to a clearer accounting
The next updates that matter will establish what happened, what was recovered and when customers can use exchange services again.
Trace
Investigators and issuers continue tracking and freezing assets.
Investigate
Binance examines the suspected device and internal services.
Account
Public findings can clarify losses, recoveries and attribution.
Restore
Deposits and withdrawals resume when Binance deems them safe.
05 / Key questions
What the headline does—and does not—say
Was $6.36 billion confirmed stolen?
Investigators reported about $6.36 billion moving from Binance-associated wallets. The available information does not provide a final net-loss figure after freezes or recoveries.
Does the report prove customer funds were taken?
No. Binance says the assets came from company-controlled holdings and customer funds remain safe. That is the exchange’s statement; service access and the final accounting remain important.
Is the North Korean attribution confirmed?
No. TRM Labs and Chainalysis reportedly made that attribution. Binance has not formally confirmed it, so it remains an outside assessment.
Could this become history’s largest heist?
By reported transfer value, it would exceed the cited Bybit theft. Whether it is the largest by confirmed final loss remains unsettled while investigations and recovery efforts continue.
Why Exchange Controls Matter
The reported scale makes this a major test of exchange security and crisis response, not simply of the underlying blockchains. The available account points to a possible compromise of an employee device or internal services rather than a failure in the cryptocurrency networks themselves. If that account is borne out, it would show how access to centralized operational systems can put large pools of digital assets at risk even when the networks processing transfers continue to function.
For customers, the distinction between company funds being stolen and customer balances being stolen is important, but it does not remove the immediate effect of an exchange halting withdrawals. People may be unable to move or use their assets while a platform investigates. Binance’s assurance that customer funds are safe is a company statement; users’ access depends on the resumption of services and on the exchange’s eventual accounting.
The separate Polymarket incident underscores that the risks are not limited to one exchange or one kind of breach. The reported attack involved a third-party software provider and affected user accounts, illustrating how platforms can be exposed through vendors and active sessions as well as through their own infrastructure. The cases are separate, and the source does not establish a connection between them.
Products Worth Considering
Trezor Safe 7 Crypto Hardware Wallet
Ledger Flex + Folio Crypto Hardware Wallet
Ledger Stax Crypto Wallet with Touchscreen
As an affiliate, we earn on qualifying purchases.
Two Platforms, Separate Incidents
The reported Binance transfers were detected late Thursday, Oct. 29. TRM Labs’ account places much of the movement within a short period across ten blockchains. Binance’s preliminary explanation focused on a potentially compromised engineer laptop, but the company has not provided a complete public incident timeline or a final determination of the entry point.
TRM Labs and Chainalysis reportedly attributed the Binance attack to TraderTraitor, a hacking operation associated with North Korea and linked by those firms to previous cryptocurrency thefts, including the Bybit breach. Binance has not formally confirmed that attribution. It should be treated as an assessment by outside blockchain intelligence firms, not as an established finding by the exchange or investigators.
On the same Thursday, Polymarket restricted international trading and suspended some transaction services after a separate security issue involving an outside software provider. Researchers said malicious code may have used active sessions to make unauthorized transactions. The estimated loss was about $2.7 million across more than 700 accounts. Polymarket said the vulnerability had been addressed and affected customers would be reimbursed, according to the supplied source material.
“Approximately $6.36 billion was moved across ten different blockchains, with much of the activity occurring within roughly 20 minutes.”
— TRM Labs
Attribution and Recovery Remain Open
Several central facts have not been settled publicly: the complete route by which attackers allegedly gained access, whether additional systems were affected, and the final amount of assets lost. The reported $6.36 billion is based on transfers identified by blockchain investigators; the source material does not establish a final net-loss figure after freezes, recoveries, or any other accounting.
The reported North Korean link is an attribution by TRM Labs and Chainalysis, not a formal confirmation from Binance. The source material also does not identify independent findings from law enforcement or establish that the suspected laptop compromise was the sole entry point. Binance’s claim that customer funds are safe has not been accompanied here by an independent audit or detailed proof of reserves.
For Polymarket, the reported estimate of $2.7 million and more than 700 affected accounts is attributed to investigators. The supplied information does not give a final loss total, explain the complete technical method, or say when all affected users will receive reimbursement.
Withdrawal Service and Investigations
Binance’s next immediate step is to complete its investigation and restore deposits and withdrawals when it determines that services can safely resume. The exchange has said it will use corporate reserves and other resources to cover the reported company-held assets, while investigators and issuers continue efforts to freeze or trace funds. Customers will be looking for a clear service-restoration update and a fuller account of the incident.
Further public findings could clarify the suspected employee-device compromise, identify whether other internal services were exposed, and provide a firmer estimate of unrecovered assets. Until those details are released, the theft’s final scale and the outside attribution remain provisional. Polymarket’s stated next step is reimbursement for affected users after addressing the reported software vulnerability; timing and the final scope of payments are not specified in the source material.
Key Questions
Was $6.36 billion confirmed stolen from Binance?
Blockchain investigators reported that about $6.36 billion moved from Binance-associated wallets. The supplied information does not provide a final net-loss accounting after freezes or recoveries, so the amount should be treated as a reported transfer estimate rather than a settled final loss.
Does Binance say customer funds were taken?
No. Binance says the cryptocurrency came from company-controlled holdings and that customer funds remain safe. The exchange has suspended deposits and withdrawals during its investigation, and the source material does not include an independent audit of its statement.
Could this be the largest cryptocurrency theft?
By the reported value of the transfers, it could exceed the approximately $1.5 billion Bybit hack from February 2025. Whether it becomes the largest theft by final losses depends on what investigators confirm and how much of the assets is recovered.
Who is believed to be behind the Binance attack?
TRM Labs and Chainalysis reportedly attributed it to TraderTraitor, an operation associated with North Korea. Binance has not formally confirmed that attribution, so responsibility remains unconfirmed in the supplied information.
What happened at Polymarket?
Polymarket temporarily restricted international trading and some transaction services after a separate reported breach involving an outside software provider. Investigators estimated about $2.7 million was taken from more than 700 accounts; the platform said the vulnerability was addressed and affected customers would be reimbursed.
Source: Off Grid Survival
