TL;DR
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
A supplied report alleges that about $6.36 billion in cryptocurrency moved from Binance-associated wallets on Oct. 29, but the incident’s scale and cause are not independently established in the material provided. The report says Binance paused withdrawals, while also describing a separate Polymarket breach with estimated losses of about $2.7 million.
A report alleges that about $6.36 billion in cryptocurrency was moved from wallets associated with Binance on Oct. 29, prompting the exchange to suspend deposits and withdrawals while it investigated. The account identifies the transfers as a possible record-setting theft, but the material provided does not independently verify the amount, whether all of it was stolen, or the attackers’ route into the exchange.
The report cites blockchain intelligence firm TRM Labs as estimating that roughly $6.36 billion moved across ten blockchains, with much of the activity occurring in about 20 minutes. Those figures are attributed estimates, not independently confirmed findings in the material provided. It is not clear from the source whether the entire reported amount represents a final loss, or whether any transfers were internal movements or otherwise recoverable.
According to the account, Binance’s preliminary inquiry pointed to a possible compromise of a laptop used by a DevOps engineer. Attackers allegedly used access to internal services to submit withdrawals that the system accepted. The report says investigators identified other possible compromise points, and that the sequence of events remained under review. Binance is quoted as saying customer funds were safe and that company reserves could cover losses; the source does not provide documentation for either assertion.
The same report describes a separate incident at Polymarket. It says the prediction-market platform restricted international trading after a compromised outside software provider was linked to unauthorized transactions. Investigators reportedly estimated about $2.7 million was taken from more than 700 accounts. Polymarket is reported to have said the vulnerability was addressed and affected customers would be reimbursed, but the supplied material contains no direct statements or independent confirmation.
$6.36 Billion Crypto Transfer Claim: What We Know
A supplied report alleges billions moved from Binance-associated wallets on Oct. 29. The amount, cause and final losses have not been independently established in the material provided.
Two platforms, separate allegations
The supplied account describes two incidents with different reported paths. It does not establish a connection between them.
Transfers under review
Report dates activity to Oct. 29 and says Binance paused deposits and withdrawals while investigating. The precise status and duration are not confirmed here.
Possible internal access
The report describes a possible compromise of a DevOps engineer’s laptop and access to internal services. The sequence remains under investigation.
Third-party exposure
A separate alleged breach reportedly involved an outside software provider and more than 700 accounts. Estimated losses were about $2.7 million.
What the figures do—and don’t—show
All values below are claims attributed in the supplied report, not independently confirmed findings.
A record remains conditional
The report compares the alleged Binance-related amount with a reported $1.5 billion theft from Bybit in February 2025. Until the Binance transfer total and its characterization are verified, a record-setting claim cannot be established.
Bars compare the amounts quoted in the source ($6.36B, $1.5B and $2.7M); they do not indicate confirmed losses.
A pause can create a separate risk
If withdrawals were suspended, customers could be unable to move or spend funds while services were paused—even if balances remained visible. That access risk is distinct from proof of loss in an individual account.
“Customer funds were safe” and reserves could cover losses.
Binance statements as described in the report; documentation not providedFrom suspected access to investigation
The sequence below reflects preliminary descriptions in the source. Each step remains subject to verification.
Report says an employee laptop may have been accessed.
Attackers allegedly used access to submit withdrawals.
Large movements were reportedly detected across networks.
The account says Binance suspended deposits and withdrawals.
Cause, final loss and recoveries remain unsettled.
Key questions still need answers
Independent confirmation and further updates would clarify scope, responsibility and customer outcomes.
Was $6.36 billion stolen?
The supplied material gives an attributed estimate, but no transaction list, final accounting, or independent confirmation from Binance. Transfers may not all represent a final loss.
Who was responsible?
The report attributes a possible North Korea link to outside firms and names TraderTraitor. It says Binance had not formally confirmed responsibility; attribution is not proof of identity.
How much can be recovered?
The source claims about $3 billion in assets was frozen by investigators and issuers, without supporting detail. The figure and any eventual recovery total remain unverified.
Were customers reimbursed?
The report says the vulnerability was addressed and affected users would be reimbursed. Timing, eligibility and completion are not documented in the supplied material.
Withdrawal Pauses Put Access at Risk
If the Binance figures are accurate, the alleged transfer would represent an extraordinary security and operational event for a major exchange. Even before the final loss is established, suspending withdrawals can leave customers unable to access funds on the platform. That is a distinct risk from a confirmed loss in an individual account: users may see a balance but still be unable to move or spend it while services are paused.
The report also points to a potential weakness in the centralized services and employee devices that exchanges use to manage digital assets. Its account does not say that the underlying blockchains themselves failed. If the suspected internal-access route is confirmed, the incident would underline how security controls around an exchange can matter as much as the networks on which its tokens operate.
The separate Polymarket allegation illustrates another exposure: platforms can be affected through outside software providers, not only through their own systems. Taken together, the incidents raise questions about customer access, third-party security and how quickly platforms can establish what happened. The claims remain subject to verification.
Products Worth Considering
Ledger Flex + Folio Crypto Hardware Wallet
Trezor Safe 5 Crypto Hardware Wallet with Color Touchscreen, Black Graphite
Ledger Flex Crypto Wallet
As an affiliate, we earn on qualifying purchases.
Two Platforms, Separate Alleged Breaches
The account dates the Binance-related transfers to Thursday, Oct. 29, and describes blockchain investigators as spotting unusually large movements from exchange-associated wallets. It compares the alleged amount with a reported $1.5 billion theft from Bybit in February 2025. Because neither the amount nor the characterization of the Binance transfers is independently confirmed in the supplied material, the comparison should be treated as conditional rather than as an established record.
The source attributes the Binance attack to TraderTraitor, a hacking operation it says has been associated with North Korea, citing TRM Labs and Chainalysis. It also acknowledges that Binance had not formally confirmed who was responsible. Attribution to a threat group is an investigative assessment, not proof of the identity or location of the people behind a particular incident.
Polymarket’s reported breach is described as a separate event involving a third-party software provider and active user sessions. The source says the platform restricted international trading and some transaction services during its investigation. It does not establish that the two incidents were connected.
“The vulnerability has been addressed and affected customers will be reimbursed.”
— Polymarket, as described in the supplied report
Loss Total and Cause Still Unverified
The most important unanswered question is whether $6.36 billion was actually stolen, rather than moved between wallets or included in a preliminary estimate. The supplied source gives no transaction list, independent confirmation from Binance, or final accounting of assets lost and recovered. It also does not establish whether the reported transfer total represents one incident or multiple movements.
The account describes a compromised employee laptop and internal services as preliminary investigative possibilities, not settled findings. The reported North Korean link is also an attribution by outside firms; Binance is said not to have confirmed responsibility. The status of Binance deposits and withdrawals, the number of affected customers, and the amount ultimately recoverable are not confirmed in the material.
For Polymarket, the report gives an estimated loss and account count but does not name the software provider, explain the full attack path, or document completed reimbursements. It also does not show whether the two platforms’ incidents shared any cause or were related.
Investigations and Access Updates
Binance’s next reported steps are to determine how attackers gained access, check whether other systems were affected, and establish the amount of any final loss. Customers will need updates from the exchange on withdrawal availability and whether any assets can be recovered. The source gives no confirmed timetable for those updates or for the restoration of normal services.
Investigators and blockchain intelligence firms may revise their estimates as they trace transactions and identify funds that can be frozen or returned. The report says about $3 billion in assets was frozen by investigators and cryptocurrency issuers, but supplies no supporting detail; that figure should be treated as an attributed claim until verified. Any recovery total will depend on further tracing and confirmation.
Polymarket’s reported follow-up is to address the third-party vulnerability and reimburse affected users. The timing, eligibility rules and completion of those payments remain unspecified. Further statements from both platforms or independent investigators would help establish the scope and outcome of the incidents.
Key Questions
Has Binance confirmed that $6.36 billion was stolen?
No confirmation appears in the supplied material. The amount is attributed to an estimate by TRM Labs, and it remains unclear whether all the reported transfers represent a final theft or loss.
How did the alleged Binance attack happen?
The report says Binance’s preliminary investigation pointed to a possible compromised DevOps engineer’s laptop and access to internal services. It describes this as an early theory, with the full sequence still under investigation.
Who is believed to be responsible?
The report says TRM Labs and Chainalysis attributed the attack to TraderTraitor, which they associate with North Korea. Binance is reported not to have formally confirmed the attribution, so responsibility remains unverified.
What happened at Polymarket?
The source describes a separate breach involving a compromised third-party software provider. It says investigators estimated about $2.7 million was taken from more than 700 accounts, while the platform restricted some activity during its response.
When can customers withdraw funds again?
The supplied material does not give a confirmed restoration time for Binance withdrawals. Customers should rely on direct updates from the exchange for current service status.
Source: Off Grid Survival
