Binance loses $6.3 billion in a hack blamed on North Korea, and Polymarket is drained through a vendor

The loss is large, but the record shows no change in law, sanctions or alliances, so the risks are mostly financial and reputational.

The nearest tests are whether Binance reopens withdrawals and whether US officials formally name North Korea.

Confidence on the mechanism is high for the theft itself and medium for the attribution, because two analytics firms agree but Binance has not named an attacker. Confidence on the horizon is medium, because recovery moves slowly and the first tests are weeks away.^8,4

Analyst assessment. Each call is scored once its date passes.

• Binance's official channels, updated through the day: whether withdrawals reopen and whether outflows stay orderly.
• TRM Labs and Chainalysis blog posts, updated as the funds move: any shift of the unfreezable bitcoin and ether through bridges and swap services.
• The FBI's public notices, issued case by case: whether it names TraderTraitor.
• Tether and Circle announcements, as they occur: any court order or release of frozen tokens.
• Polymarket's status posts on X: whether it discloses how many users were affected and how much was taken.

The operational record shows a fast theft, rapid freezes by stablecoin issuers, and frozen totals that differ by hour and by source.

TRM says most of the money left Binance wallets in about 20 minutes, starting at 20:05 Coordinated Universal Time (UTC) on October 29th, 2026.⁵ Tether and Circle froze large amounts that night. Reuters reports Tether froze nearly $1.57 billion and Circle more than $800 million.¹

The frozen total depends on who counts and when. Binance said at 23:35 UTC that its verified frozen total had reached $2.54 billion.⁵ TRM counted about $2.7 billion frozen on chain as of 00:30 UTC on October 30th.⁵ Binance later said it had located about $3 billion, and Chainalysis said it had supported a freeze of about that amount.⁸ Al Jazeera's report uses the $3 billion figure, while its web address still carries the earlier $2.54 billion count.²

The size of the theft also varies. TRM puts it at about $6.36 billion, valuing each transfer at the price when it was taken.⁵ Chainalysis said it had confirmed at least $5.912 billion as of 8:30 p.m. Eastern Time (ET) on October 29th.⁸ Chainalysis chief executive Jonathan Levin put it at $6.4 billion.⁴ Al Jazeera reports that Binance said about $6.3 billion was stolen, but the Guardian reports Binance did not explicitly confirm a theft.^2,6

Polymarket's loss is reported at $2.65 million by The Block and at about $2.5 million traced by BleepingComputer. Polymarket has not disclosed how much was stolen.^7,3

Polymarket halted trading in the afternoon of October 29th, and the Binance theft followed that evening.

Binance

Richard Teng

Co-chief executive, Binance

Says Binance is covering every loss and that its investigation has not attributed responsibility to any individual.¹

What to watch

• Binance's technical post-mortem, which it says it will share once investigations are complete.²

Binance

Yi He

Co-founder and co-chief executive, Binance

Said Binance would cover all hacking losses.⁹ Also said Ripple, a crypto firm, helped stop about $200 million from moving.⁵

What to watch

• Whether Binance publishes a full count of what was frozen.

Binance

Changpeng Zhao

Founder and largest shareholder, Binance

No longer runs the company. Said the incident looked like a hack and that he expects all user funds to be fully covered.⁶

Polymarket

Polymarket

Prediction market platform

Says one of its third-party providers was compromised and that affected traders will be made whole.³

What to watch

• Whether it discloses how many users were affected and how much was stolen.³

North Korea

TraderTraitor

North Korean state hacking unit

Named by TRM and Chainalysis as responsible, with high confidence. North Korea routinely denies state hacking.¹

What to watch

• Moves of the unfrozen funds through bridges and swap services, which TRM expects next.⁵

Portraits after photographs. Richard Teng: Binance, via Wikimedia Commons, CC BY 4.0; Changpeng Zhao: Aevozer, via Wikimedia Commons, CC BY-SA 4.0.

Several headline claims hold less than they appear to: the exact loss, the frozen amount, the cause and any link between the two hacks.

• The $6.3 billion loss is an estimate. Analysts' counts range from at least $5.912 billion to $6.4 billion, and Binance has not published its own breakdown.^8,4
• A frozen amount is not a recovered amount. Eric Jardine, head of research at Chainalysis, says a technical freeze may happen quickly while returning funds can take months or years.⁴
• The engineer's laptop may be only part of the story. Binance later said it had uncovered additional points of breach.¹ TRM says the evidence points to a compromise of Binance's wallet signing system across several blockchains.⁵
• North Korea is the analysts' judgment. TRM and Chainalysis say they are highly confident, and Binance says its investigation has not attributed responsibility to any individual.¹
• No source ties the two hacks to one operation. The Independent describes the Polymarket halt as an unrelated incident.⁹ The link in this alert is the type of weak point.

A theft this size tests how much risk sits in an exchange's own people and vendors, and how fast issuers and investigators can claw back stolen funds.

Binance is the world's biggest exchange, with about $162.8 billion in assets under custody as of its 2025 annual report.¹ Cristiano Ventricelli, a vice president for digital assets at Moody's Ratings, a credit rating agency, says that scale can amplify the impact of a breach. He adds that the wider credit effects depend on the final losses and on asset recovery.⁹

The stolen money may also matter beyond finance. Redbord of TRM says that when North Korea steals at this scale, the money funds weapons proliferation and other destabilising activity.² That is TRM's view. No government statement in the sources we read confirms how the money would be used.

For Polymarket, the lesson is narrower. Hackers used code hosted by DebugBear, a website performance-monitoring service, to hijack logged-in trading sessions.³ Any firm that loads an outside script on a page where customers hold funds carries that exposure.

Exchanges and crypto-linked shares carry the immediate cost, while stablecoin issuers showed they can limit it.

Each reader type has a different first question: exposure, allocation, vendors or screening.

A counterparty's answers on custody, vendors and incident response show where its risk really sits.

• Custody: How are hot wallet keys protected, and how is signing separated by blockchain and wallet tier? TRM advises this separation.⁵
• Workstations: Can one engineer's laptop reach a system that can submit withdrawals? Binance says that is how its incident may have begun.⁶
• Vendors: Which outside scripts run on pages where customers sign in or move funds, and who approves changes?
• Response: How fast can the firm halt trading and freeze flows? Polymarket went to cancel-only mode at 2:05 p.m. ET, after the first losses.³
• Coverage: What backs a promise to cover all losses? Binance's secure asset fund is about $1 billion in bitcoin, according to its website.¹

We judge the theft real and the North Korea attribution probable, and we expect recovery to be partial and slow.

Confidence: high on the facts of the theft, medium on attribution, low on how much is recovered. Many outlets report the theft. TRM and Chainalysis both attribute it to TraderTraitor, and Chainalysis says funds from a North Korea-linked Bitget exploit last month mixed with funds stolen from Binance.⁸ Binance itself has not named an attacker.¹

Escalation test: none of the five criteria is met. The asset freezes came from private issuers, not from a government.¹ That keeps the alert at Market-Relevant Uncertainty.

Primary assessment: frozen stablecoins are the most recoverable part, and the unfrozen bitcoin and ether depend on tracing them to cooperating exchanges.⁴ TRM expects the attacker to move next through bridges, swap services and over-the-counter brokers.⁵

Strongest alternative: Binance's account of a compromised laptop is the full cause, and the signing-system theory from TRM is wrong. Binance has promised a post-mortem.² Until then the cause is open.

Where we diverge from coverage: most outlets treat the two hacks as separate stories, and the sources we read give no link between the attackers. We read them together only as two cases where the way in sat outside the core of the platform.

What would make us wrong: a Binance post-mortem pointing away from North Korea, a US government attribution to another actor, or large frozen sums returned within weeks.

The Binance theft repeats features of earlier North Korea-linked heists, with a different laundering route so far.

A hot wallet is a wallet connected to the internet that an exchange uses to process customer withdrawals. TRM says the attacker submitted 50 pre-signed authorizations, and one of them turned Binance's Ethereum hot wallet into a sweeper the attacker controlled.⁵

TRM says the attack matches earlier North Korea-linked heists, including Bybit in February 2025, in its use of Tornado Cash funding and signatures obtained in advance. The laundering seen so far relies on swaps through market makers and lending protocols, unlike the bridge-heavy pattern after Bybit.⁵

Bitget, another exchange, said in September that about $350 million in crypto had been stolen.¹ Chainalysis says it saw funds from last month's North Korea-linked Bitget exploit mixing with funds stolen from Binance.⁸ Ari Redbord, global head of policy at TRM Labs, told CNBC on October 30th, 2026 why a freeze falls short of recovery.

1. Hackers steal $6.3 billion from Binance in record heist blamed on North Korea. Reuters, October 29th, 2026
2. Binance says $6.3bn stolen in biggest crypto heist in history. Al Jazeera, October 30th, 2026
3. Polymarket halts trading after crypto-draining script breach, $2.5M traced. BleepingComputer, October 29th, 2026
4. Binance's $6.3 billion hack: What we know and what comes next. CNBC, October 30th, 2026
5. North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History. TRM Labs, October 30th, 2026
6. North Korean group blamed for $6.3bn Binance hack in biggest ever crypto heist. The Guardian, October 30th, 2026
7. Polymarket resumes trading after $2.65 million exploit, says third-party provider was compromised. The Block, October 29th, 2026
8. NEWS: North Korea blamed as $6.3 billion stolen in latest scandal at Binance. AML Intelligence, October 30th, 2026
9. North Korean hackers blamed for huge Binance heist that put crypto market in chaos. The Independent, October 30th, 2026